Vulnerability Description
The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Usg Flex 100 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 100 | - |
| Zyxel | Usg Flex 100W Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 100W | - |
| Zyxel | Usg Flex 200 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 200 | - |
| Zyxel | Usg Flex 50 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 50 | - |
| Zyxel | Usg Flex 50W Firmware | >= 5.10, <= 5.35 |
| Zyxel | Usg Flex 50W | - |
| Zyxel | Usg Flex 500 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 500 | - |
| Zyxel | Usg Flex 700 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Usg Flex 700 | - |
| Zyxel | Vpn100 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Vpn100 | - |
| Zyxel | Vpn1000 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Vpn1000 | - |
| Zyxel | Vpn300 Firmware | >= 5.00, <= 5.35 |
| Zyxel | Vpn300 | - |
Related Weaknesses (CWE)
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
FAQ
What is CVE-2023-22916?
CVE-2023-22916 is a vulnerability with a CVSS score of 8.1 (HIGH). The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN ...
How severe is CVE-2023-22916?
CVE-2023-22916 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-22916?
Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Usg Flex 100 Firmware, Zyxel Usg Flex 100, Zyxel Usg Flex 100W Firmware, Zyxel Usg Flex 100W, Zyxel Usg Flex 200 Firmware.