PT-2023-7463 · Zyxel · Zyxel Atp Series+7

Nikita Abramov · Published 2023-01-10 · Updated 2023-06-12 · CVE-2023-22918

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50(W) versions 4.16 through 5.35 Zyxel USG20(W)-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Zyxel NWA110AX versions 6.50(ABTG.2) and earlier Zyxel WAC500 versions 6.50(ABVS.0) and earlier Zyxel WAX510D versions 6.50(ABTF.2) and earlier

Description The issue is related to a post-authentication information exposure vulnerability in the CGI program of the affected Zyxel devices. This vulnerability could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device. The vulnerability is associated with inadequate access restrictions to personal information.

Recommendations For Zyxel ATP series versions 4.32 through 5.35, update to a version outside of this range to resolve the issue. For Zyxel USG FLEX series versions 4.50 through 5.35, update to a version outside of this range to resolve the issue. For Zyxel USG FLEX 50(W) versions 4.16 through 5.35, update to a version outside of this range to resolve the issue. For Zyxel USG20(W)-VPN versions 4.16 through 5.35, update to a version outside of this range to resolve the issue. For Zyxel VPN series versions 4.30 through 5.35, update to a version outside of this range to resolve the issue. For Zyxel NWA110AX versions 6.50(ABTG.2) and earlier, update to a version later than 6.50(ABTG.2) to resolve the issue. For Zyxel WAC500 versions 6.50(ABVS.0) and earlier, update to a version later than 6.50(ABVS.0) to resolve the issue. For Zyxel WAX510D versions 6.50(ABTF.2) and earlier, update to a version later than 6.50(ABTF.2) to resolve the issue.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

BDU:2023-08506

CVE-2023-22918

Affected Products

Zyxel Atp Series

Zyxel Nwa110Ax

Zyxel Usg Flex 50

Zyxel Usg Flex Series

Zyxel Usg20(W)-Vpn

Zyxel Vpn Series

Zyxel Wac500

Zyxel Wax510D

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-22918 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22918 · Vendor Advisory
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08506 · Security Note
• https://ptsecurity.com/ru-ru/about/news/positive-technologies-pomogla-zakryt-uyazvimosti-v-mezhsetevyh-ehkranah-i-tochkah-dostupa-zyxel · Note
• https://t.me/cibsecurity/62755 · Telegram Post