High severity · published Jul 17, 2023
CVE-2023-34141
A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware…
8.0
CVSS
0.7%
EPSS
No
On KEV
Description
A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nxc2500 Firmware · Zyxel
6.10\(aaig.0\) through 6.10\(aaig.3\) · source: NVD
NF
Nxc5500 Firmware · Zyxel
6.10\(aaos.0\) through 6.10\(aaos.4\) · source: NVD
U2
Usg 20w-vpn Firmware · Zyxel
5.00 before 5.37 · source: NVD
U2
Usg 2200-vpn Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 100 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 100w Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 200 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 50 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 500 Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 50w Firmware · Zyxel
5.00 before 5.37 · source: NVD
UF
Usg Flex 700 Firmware · Zyxel
5.00 before 5.37 · source: NVD
ZA
Zywall Atp100 Firmware · Zyxel
5.00 before 5.37 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-34141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-34141
Vendor Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
More from Nxc2500 Firmware
7.8
CVE-2022-26532
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through…
7.8
CVE-2022-26531
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions…
6.5
CVE-2023-34140
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W)…