Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2023-4398 (GCVE-0-2023-4398)

Vulnerability from nvd – Published: 2023-11-28 01:48 – Updated: 2024-10-17 17:38

Summary

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:28 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: versions 4.32 through 5.37
Zyxel	USG FLEX series firmware	Affected: versions 4.50 through 5.37
Zyxel	USG FLEX 50(W) series firmware	Affected: versions 4.16 through 5.37
Zyxel	USG20(W)-VPN series firmware	Affected: versions 4.16 through 5.37
Zyxel	VPN series firmware	Affected: versions 4.30 through 5.37
zyxel	atp_firmware	Affected: 4.32 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:atp_firmware:0:::::::*
zyxel	usg_flex_firmware	Affected: 4.50 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg_flex_firmware::::::::
zyxel	usg_flex_50w_firmware	Affected: 4.16 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware::::::::
zyxel	usg20w-vpn_firmware	Affected: 4.16 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 5.30 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:24:04.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp_firmware:0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "atp_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.32",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "5.30",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:28:40.928455Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-17T17:38:37.172Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.32 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.50 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.16 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.16 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.30 through 5.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet."
            }
          ],
          "value": "An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T01:48:28.586Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-4398",
    "datePublished": "2023-11-28T01:48:28.586Z",
    "dateReserved": "2023-08-17T08:27:42.249Z",
    "dateUpdated": "2024-10-17T17:38:37.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34141 (GCVE-0-2023-34141)

Vulnerability from nvd – Published: 2023-07-17 17:56 – Updated: 2024-10-29 16:06

Summary

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-29 15:54 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

14 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG FLEX series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG FLEX 50(W) series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG20(W)-VPN series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	NXC2500 firmware	Affected: 6.10(AAIG.0) through 6.10(AAIG.3)
Zyxel	NXC5500 firmware	Affected: 6.10(AAOS.0) through 6.10(AAOS.4)
zyxel	atp	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:h:zyxel:atp:-:::::::*
zyxel	usg_flex	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:h:zyxel:usg_flex:-:::::::*
zyxel	usg_flex_50w_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:::::::*
zyxel	usg20w-vpn_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::
zyxel	nxc2500_firmware	Affected: 6.10(AAIG.0) , ≤ 6.10(AAIG.3) (custom) cpe:2.3:o:zyxel:nxc2500_firmware:-:::::::*
zyxel	nxc5500_firmware	Affected: 6.10(AAOS.0) , ≤ 6.10(AAOS.4) (custom) cpe:2.3:o:zyxel:nxc5500_firmware:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:zyxel:atp:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "atp",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:zyxel:usg_flex:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nxc2500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nxc2500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "6.10(AAIG.3)",
                "status": "affected",
                "version": "6.10(AAIG.0)",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nxc5500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nxc5500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "6.10(AAOS.4)",
                "status": "affected",
                "version": "6.10(AAOS.0)",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34141",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T15:54:42.546431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T16:06:41.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NXC2500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "6.10(AAIG.0) through 6.10(AAIG.3)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NXC5500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": " 6.10(AAOS.0) through 6.10(AAOS.4)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance."
            }
          ],
          "value": "A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T17:56:26.818Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34141",
    "datePublished": "2023-07-17T17:56:26.818Z",
    "dateReserved": "2023-05-26T03:44:51.339Z",
    "dateUpdated": "2024-10-29T16:06:41.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34139 (GCVE-0-2023-34139)

Vulnerability from nvd – Published: 2023-07-17 17:36 – Updated: 2024-10-29 16:19

Summary

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-29 16:18 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

4 products

Vendor	Product	Version
Zyxel	USG FLEX series firmware	Affected: 4.50 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 4.20 through 5.36 Patch 2
zyxel	usg_flex_firmware	Affected: 4.50 , ≤ 5.36_Patch-2 (custom) cpe:2.3:o:zyxel:usg_flex_firmware:-:::::::*
zyxel	vpn_firmware	Affected: 4.20 , ≤ 5.36_Patch-2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:54.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_Patch-2",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_Patch-2",
                "status": "affected",
                "version": "4.20",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T16:18:52.786892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T16:19:03.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.50 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.20 through 5.36 Patch 2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2,\u0026nbsp;could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device."
            }
          ],
          "value": "A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2,\u00a0could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-18T01:16:42.677Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34139",
    "datePublished": "2023-07-17T17:36:32.909Z",
    "dateReserved": "2023-05-26T03:44:51.339Z",
    "dateUpdated": "2024-10-29T16:19:03.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34138 (GCVE-0-2023-34138)

Vulnerability from nvd – Published: 2023-07-17 17:31 – Updated: 2024-10-30 18:02

Summary

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-30 17:59 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG FLEX series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG FLEX 50(W) series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG20(W)-VPN series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 4.60 through 5.36 Patch 2
zyxel	atp_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:atp_firmware:-:::::::*
zyxel	usg_flex_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg_flex_firmware:-:::::::*
zyxel	usg_flex_50w_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:::::::*
zyxel	usg20w-vpn_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:54.181Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "atp_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T17:59:03.869372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T18:02:28.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance."
            }
          ],
          "value": "A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T18:01:33.075Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34138",
    "datePublished": "2023-07-17T17:31:40.719Z",
    "dateReserved": "2023-05-26T03:44:51.338Z",
    "dateUpdated": "2024-10-30T18:02:28.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-4398 (GCVE-0-2023-4398)

Vulnerability from cvelistv5 – Published: 2023-11-28 01:48 – Updated: 2024-10-17 17:38

Summary

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:28 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: versions 4.32 through 5.37
Zyxel	USG FLEX series firmware	Affected: versions 4.50 through 5.37
Zyxel	USG FLEX 50(W) series firmware	Affected: versions 4.16 through 5.37
Zyxel	USG20(W)-VPN series firmware	Affected: versions 4.16 through 5.37
Zyxel	VPN series firmware	Affected: versions 4.30 through 5.37
zyxel	atp_firmware	Affected: 4.32 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:atp_firmware:0:::::::*
zyxel	usg_flex_firmware	Affected: 4.50 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg_flex_firmware::::::::
zyxel	usg_flex_50w_firmware	Affected: 4.16 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware::::::::
zyxel	usg20w-vpn_firmware	Affected: 4.16 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 5.30 , ≤ 5.37 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:24:04.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp_firmware:0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "atp_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.32",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37",
                "status": "affected",
                "version": "5.30",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:28:40.928455Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-17T17:38:37.172Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.32 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.50 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.16 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.16 through 5.37"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions 4.30 through 5.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet."
            }
          ],
          "value": "An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions on an affected device by sending a crafted IKE packet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T01:48:28.586Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-4398",
    "datePublished": "2023-11-28T01:48:28.586Z",
    "dateReserved": "2023-08-17T08:27:42.249Z",
    "dateUpdated": "2024-10-17T17:38:37.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34141 (GCVE-0-2023-34141)

Vulnerability from cvelistv5 – Published: 2023-07-17 17:56 – Updated: 2024-10-29 16:06

Summary

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-29 15:54 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

14 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG FLEX series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG FLEX 50(W) series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	USG20(W)-VPN series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 5.00 through 5.36 Patch 2
Zyxel	NXC2500 firmware	Affected: 6.10(AAIG.0) through 6.10(AAIG.3)
Zyxel	NXC5500 firmware	Affected: 6.10(AAOS.0) through 6.10(AAOS.4)
zyxel	atp	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:h:zyxel:atp:-:::::::*
zyxel	usg_flex	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:h:zyxel:usg_flex:-:::::::*
zyxel	usg_flex_50w_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:::::::*
zyxel	usg20w-vpn_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 5.00 , ≤ 5.36_patch-2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::
zyxel	nxc2500_firmware	Affected: 6.10(AAIG.0) , ≤ 6.10(AAIG.3) (custom) cpe:2.3:o:zyxel:nxc2500_firmware:-:::::::*
zyxel	nxc5500_firmware	Affected: 6.10(AAOS.0) , ≤ 6.10(AAOS.4) (custom) cpe:2.3:o:zyxel:nxc5500_firmware:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:zyxel:atp:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "atp",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:zyxel:usg_flex:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_patch-2",
                "status": "affected",
                "version": "5.00",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nxc2500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nxc2500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "6.10(AAIG.3)",
                "status": "affected",
                "version": "6.10(AAIG.0)",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nxc5500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nxc5500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "6.10(AAOS.4)",
                "status": "affected",
                "version": "6.10(AAOS.0)",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34141",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T15:54:42.546431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T16:06:41.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "5.00 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NXC2500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "6.10(AAIG.0) through 6.10(AAIG.3)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NXC5500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": " 6.10(AAOS.0) through 6.10(AAOS.4)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance."
            }
          ],
          "value": "A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T17:56:26.818Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34141",
    "datePublished": "2023-07-17T17:56:26.818Z",
    "dateReserved": "2023-05-26T03:44:51.339Z",
    "dateUpdated": "2024-10-29T16:06:41.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34139 (GCVE-0-2023-34139)

Vulnerability from cvelistv5 – Published: 2023-07-17 17:36 – Updated: 2024-10-29 16:19

Summary

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-29 16:18 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

4 products

Vendor	Product	Version
Zyxel	USG FLEX series firmware	Affected: 4.50 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 4.20 through 5.36 Patch 2
zyxel	usg_flex_firmware	Affected: 4.50 , ≤ 5.36_Patch-2 (custom) cpe:2.3:o:zyxel:usg_flex_firmware:-:::::::*
zyxel	vpn_firmware	Affected: 4.20 , ≤ 5.36_Patch-2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:54.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_Patch-2",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36_Patch-2",
                "status": "affected",
                "version": "4.20",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T16:18:52.786892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T16:19:03.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.50 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.20 through 5.36 Patch 2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2,\u0026nbsp;could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device."
            }
          ],
          "value": "A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2,\u00a0could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-18T01:16:42.677Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34139",
    "datePublished": "2023-07-17T17:36:32.909Z",
    "dateReserved": "2023-05-26T03:44:51.339Z",
    "dateUpdated": "2024-10-29T16:19:03.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-34138 (GCVE-0-2023-34138)

Vulnerability from cvelistv5 – Published: 2023-07-17 17:31 – Updated: 2024-10-30 18:02

Summary

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance.

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-30 17:59 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zyxel CNA under the mitre root

CNA scorecard C 67/100 over 13 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zyxel.com/global/en/support/security-…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
Zyxel	ATP series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG FLEX series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG FLEX 50(W) series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	USG20(W)-VPN series firmware	Affected: 4.60 through 5.36 Patch 2
Zyxel	VPN series firmware	Affected: 4.60 through 5.36 Patch 2
zyxel	atp_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:atp_firmware:-:::::::*
zyxel	usg_flex_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg_flex_firmware:-:::::::*
zyxel	usg_flex_50w_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:::::::*
zyxel	usg20w-vpn_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:usg20w-vpn_firmware::::::::
zyxel	vpn_firmware	Affected: 4.60 , ≤ 5.36 Patch 2 (custom) cpe:2.3:o:zyxel:vpn_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:54.181Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "atp_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.36 Patch 2",
                "status": "affected",
                "version": "4.60",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T17:59:03.869372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T18:02:28.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "4.60 through 5.36 Patch 2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance."
            }
          ],
          "value": "A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T18:01:33.075Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-34138",
    "datePublished": "2023-07-17T17:31:40.719Z",
    "dateReserved": "2023-05-26T03:44:51.338Z",
    "dateUpdated": "2024-10-30T18:02:28.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for vpn_firmware by zyxel

CVE-2023-4398 (GCVE-0-2023-4398)

CVE-2023-34141 (GCVE-0-2023-34141)

CVE-2023-34139 (GCVE-0-2023-34139)

CVE-2023-34138 (GCVE-0-2023-34138)

CVE-2023-4398 (GCVE-0-2023-4398)

CVE-2023-34141 (GCVE-0-2023-34141)

CVE-2023-34139 (GCVE-0-2023-34139)

CVE-2023-34138 (GCVE-0-2023-34138)