PT-2023-7252 · Zyxel · Zyxel Usg Flex+1

Alessandro Sgreccia · Published 2023-11-06 · Updated 2023-12-01 · CVE-2023-5960

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX series firmware versions 4.50 through 5.37 Zyxel VPN series firmware versions 4.30 through 5.37

Description The issue is related to improper privilege management in the hotspot feature of the affected devices. This could allow an authenticated local attacker to access system files on an affected device, potentially leading to unauthorized access to protected information.

Recommendations For Zyxel USG FLEX series firmware versions 4.50 through 5.37, update to a version outside of this range to resolve the issue. For Zyxel VPN series firmware versions 4.30 through 5.37, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the hotspot feature until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-08280

CVE-2023-5960

Affected Products

Zyxel Usg Flex

Zyxel Vpn

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-5960 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08280 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5960 · Vendor Advisory
• https://vuldb.com/ru/?id.246230 · Note
• https://t.me/cvenotify/61303 · Telegram Post
• https://t.me/cvenotify/61951 · Telegram Post