High severity · published Jul 17, 2023
CVE-2023-28767
The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, …
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5.10 through 5.36,
USG20(W)-VPN series firmware versions 5.10 through 5.36, and VPN series firmware versions 5.00 through 5.36. An unauthenticated, LAN-based attacker could leverage the vulnerability to inject some operating system (OS) commands into the device configuration data on an affected device when the cloud management mode is enabled.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
U2
Usg 20w-vpn Firmware · Zyxel
5.10 before 5.37 · source: NVD
U2
Usg 2200-vpn Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 100 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 100w Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 200 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 50 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 500 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 50w Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 700 Firmware · Zyxel
5.00 before 5.37 · source: NVD
ZA
Zywall Atp100 Firmware · Zyxel
5.10 before 5.37 · source: NVD
ZA
Zywall Atp100w Firmware · Zyxel
5.10 before 5.37 · source: NVD
ZA
Zywall Atp200 Firmware · Zyxel
5.10 before 5.37 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28767
Vendor Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
More from Usg 20w-vpn Firmware
9.8
CVE-2023-33009
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
9.8
CVE-2023-33010
Zyxel Multiple Firewalls Buffer Overflow Vulnerability
8.8
CVE-2023-33012
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through…
8.8
CVE-2023-33011
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W)…
8.8
CVE-2023-27991
The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through…