PT-2023-7253 · Zyxel · Zyxel Usg20(W)-Vpn Series+4

Lê Hữu Quang Linh

·

Published

2023-06-14

·

Updated

2023-12-04

·

CVE-2023-35136

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions ZyXEL VPN versions 4.30 through 5.37 ZyXEL USG FLEX series firmware versions 4.50 through 5.37 ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37 ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37 ZyXEL ATP series firmware versions 4.32 through 5.37
Description The issue is related to insufficient input validation in the Quagga package of the affected ZyXEL devices. This could allow an authenticated local attacker to access configuration files on an affected device.
Recommendations For ZyXEL VPN versions 4.30 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG FLEX series firmware versions 4.50 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL ATP series firmware versions 4.32 through 5.37, update to a version that includes the fix for the improper input validation vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-08281
CVE-2023-35136

Affected Products

Zyxel Atp Series
Zyxel Usg Flex 50(W) Series
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn Series
Zyxel Vpn