PT-2023-8711 · Zyxel · Nwa50Ax+6

Atdog + 1 · Published 2023-11-30 · Updated 2025-01-21 · CVE-2023-6398

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZyXEL USG FLEX versions 4.50 through 5.37 Patch 1 ZyXEL USG FLEX 50(W)/USG20(W)-VPN versions 4.16 through 5.37 Patch 1 ZyXEL USG FLEX H versions 1.10 through 1.10 Patch 1 ZyXEL ATP series firmware versions 4.32 through 5.37 Patch 1 NWA50AX firmware versions through 6.29(ABYW.3) WAC500 firmware versions through 6.65(ABVS.1) WAX300H firmware versions through 6.60(ACHF.1) WBE660S firmware versions through 6.65(ACGG.1)

Description The issue is related to a post-authentication command injection vulnerability in the file upload binary, allowing an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. This can be achieved by exploiting the vulnerability in the file upload process, which does not properly neutralize special elements used in the command.

Recommendations For ZyXEL USG FLEX versions 4.50 through 5.37 Patch 1, update to a version later than 5.37 Patch 1. For ZyXEL USG FLEX 50(W)/USG20(W)-VPN versions 4.16 through 5.37 Patch 1, update to a version later than 5.37 Patch 1. For ZyXEL USG FLEX H versions 1.10 through 1.10 Patch 1, update to a version later than 1.10 Patch 1. For ZyXEL ATP series firmware versions 4.32 through 5.37 Patch 1, update to a version later than 5.37 Patch 1. For NWA50AX firmware versions through 6.29(ABYW.3), update to a version later than 6.29(ABYW.3). For WAC500 firmware versions through 6.65(ABVS.1), update to a version later than 6.65(ABVS.1). For WAX300H firmware versions through 6.60(ACHF.1), update to a version later than 6.60(ACHF.1). For WBE660S firmware versions through 6.65(ACGG.1), update to a version later than 6.65(ACGG.1). As a temporary workaround, consider restricting access to the FTP service until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-01654

CVE-2023-6398

Affected Products

Nwa50Ax

Wac500

Wax300H

Wbe660S

Zyxel Atp Series

Zyxel Usg Flex

Zyxel Usg Flex 50(W)/Usg20(W)-Vpn

References · 12

• https://bdu.fstec.ru/vul/2024-01654 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6398 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6398 · Vendor Advisory
• https://t.me/cvenotify/72094 · Telegram Post
• https://t.me/cvenotify/71936 · Telegram Post
• https://vuldb.com/?id.254124 · Note
• https://twitter.com/fletch_ai/status/1762313375474704619 · Twitter Post
• https://twitter.com/MarsTighter/status/1759946514086945015 · Twitter Post
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-21-2024 · Note
• https://twitter.com/cracbot/status/1760182612231176551 · Twitter Post
• https://twitter.com/CVEnew/status/1759757909603278894 · Twitter Post