PT-2023-7252 · Zyxel · Zyxel Usg Flex+1

Alessandro Sgreccia · Publicado 2023-11-06 · Atualizado 2023-12-01 · CVE-2023-5960

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX series firmware versions 4.50 through 5.37 Zyxel VPN series firmware versions 4.30 through 5.37

Description The issue is related to improper privilege management in the hotspot feature of the affected devices. This could allow an authenticated local attacker to access system files on an affected device, potentially leading to unauthorized access to protected information.

Recommendations For Zyxel USG FLEX series firmware versions 4.50 through 5.37, update to a version outside of this range to resolve the issue. For Zyxel VPN series firmware versions 4.30 through 5.37, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the hotspot feature until a patch is available.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2023-08280

CVE-2023-5960

Produtos afetados

Zyxel Usg Flex

Zyxel Vpn

Referências · 7

• https://vuldb.com/ru/?id.246230 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5960 · Nota de Segurança
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08280 · Nota de Segurança
• https://t.me/cvenotify/61303 · Publicação no Telegram
• https://t.me/cvenotify/61951 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-5960 · Aviso do Fabricante