PT-2023-7790 · Zyxel · Zyxel Atp Series+4

Alessandro Sgreccia

·

Published

2023-04-24

·

Updated

2024-02-02

·

CVE-2023-27990

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50(W) versions 4.16 through 5.35 Zyxel USG20(W)-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35
Description The issue is related to a cross-site scripting (XSS) vulnerability that could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful attack could result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device. This is due to the lack of protection for the web page structure, which could enable a remote attacker to execute arbitrary scripts on the vulnerable device.
Recommendations For Zyxel ATP series versions 4.32 through 5.35, update to a version that includes a fix for this issue. For Zyxel USG FLEX series versions 4.50 through 5.35, update to a version that includes a fix for this issue. For Zyxel USG FLEX 50(W) versions 4.16 through 5.35, update to a version that includes a fix for this issue. For Zyxel USG20(W)-VPN versions 4.16 through 5.35, update to a version that includes a fix for this issue. For Zyxel VPN series versions 4.30 through 5.35, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the Logs page of the GUI on the device until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08857
CVE-2023-27990

Affected Products

Zyxel Atp Series
Zyxel Usg Flex 50
Zyxel Usg Flex Series
Zyxel Usg20(W)-Vpn
Zyxel Vpn Series