Back to feed
EUVD-2023-31716 · Published Apr 24, 2023
The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.
Technologies
Zyxel Usg Flex 200 FirmwareZyxel Vpn50 FirmwareZyxel Vpn300 FirmwareZyxel Atp200 FirmwareZyxel Atp100W FirmwareZyxel Usg20-VpnZyxel Vpn1000 FirmwareZyxel Atp500 FirmwareZyxel Atp100Zyxel Vpn1000Zyxel Usg Flex 100W FirmwareZyxel Usg Flex 500Zyxel Atp200Zyxel Usg Flex 700Zyxel Atp700Zyxel Usg Flex 100 FirmwareZyxel Atp500Zyxel Usg 20W-Vpn FirmwareZyxel Vpn100 FirmwareZyxel Usg Flex 100Zyxel Vpn100Zyxel Atp800 FirmwareZyxel Usg 20W-VpnZyxel Atp800Zyxel Usg Flex 100WZyxel Vpn300Zyxel Atp100 FirmwareZyxel Usg Flex 700 FirmwareZyxel Usg Flex 50Zyxel Usg Flex 50 FirmwareZyxel Vpn50Zyxel Usg Flex 50W FirmwareZyxel Usg20-Vpn FirmwareZyxel Atp100WZyxel Atp700 FirmwareZyxel Usg Flex 500 FirmwareZyxel Usg Flex 200Zyxel Usg Flex 50W
Weaknesses
CWE-78
CVSS scores
- v3.18.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
