PT-2023-3606 · Zyxel · Zyxel Atp Series+4
Atdog
+1
·
Publicado
2023-05-17
·
Atualizado
2023-07-26
·
CVE-2023-33011
CVSS v3.1
8.8
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Zyxel ATP series versions 5.10 through 5.36 Patch 2
Zyxel USG FLEX series versions 5.00 through 5.36 Patch 2
Zyxel USG FLEX 50(W) series versions 5.10 through 5.36 Patch 2
Zyxel USG20(W)-VPN series versions 5.10 through 5.36 Patch 2
Zyxel VPN series versions 5.00 through 5.36 Patch 2
Description
A format string vulnerability in the Zyxel firmware could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled. The vulnerability is related to the use of uncontrolled format strings, which may allow a remote attacker to execute arbitrary commands.
Recommendations
For Zyxel ATP series versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2.
For Zyxel USG FLEX series versions 5.00 through 5.36 Patch 2, update to a version later than 5.36 Patch 2.
For Zyxel USG FLEX 50(W) series versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2.
For Zyxel USG20(W)-VPN series versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2.
For Zyxel VPN series versions 5.00 through 5.36 Patch 2, update to a version later than 5.36 Patch 2.
As a temporary workaround, consider disabling the cloud management mode until a patch is available. Restrict access to the PPPoE configuration to minimize the risk of exploitation.
Correção
Use of Externally-Controlled Format String
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series
Zyxel Vpn Series