PT-2023-7250 · Zyxel · Zyxel Usg Flex Series+4
Alessandro Sgreccia
·
Publicado
2023-10-19
·
Atualizado
2023-12-04
·
CVE-2023-5650
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
ZyXEL USG FLEX series firmware versions 4.50 through 5.37
ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37
ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37
ZyXEL VPN series firmware versions 4.30 through 5.37
ZyXEL ATP series firmware versions 4.32 through 5.37
Description
The issue is related to improper privilege management in the ZySH of the affected devices, which could allow an authenticated local attacker to modify the URL of the registration page in the web GUI of an affected device.
Recommendations
For ZyXEL USG FLEX series firmware versions 4.50 through 5.37, update to a version outside of this range to resolve the issue.
For ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37, update to a version outside of this range to resolve the issue.
For ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37, update to a version outside of this range to resolve the issue.
For ZyXEL VPN series firmware versions 4.30 through 5.37, update to a version outside of this range to resolve the issue.
For ZyXEL ATP series firmware versions 4.32 through 5.37, update to a version outside of this range to resolve the issue.
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series
Zyxel Vpn Series