1. Home
  2. CVE Database
  3. CVE-2023-27991
HIGH · 8.8

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) ...

Vulnerability Description

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ZyxelAtp200 Firmware>= 4.32, < 5.36
ZyxelAtp200-
ZyxelAtp100 Firmware>= 4.32, < 5.36
ZyxelAtp100-
ZyxelAtp700 Firmware>= 4.32, < 5.36
ZyxelAtp700-
ZyxelAtp500 Firmware>= 4.32, < 5.36
ZyxelAtp500-
ZyxelAtp100W Firmware>= 4.32, < 5.36
ZyxelAtp100W-
ZyxelAtp800 Firmware>= 4.32, < 5.36
ZyxelAtp800-
ZyxelUsg Flex 100 Firmware>= 4.50, < 5.36
ZyxelUsg Flex 100-
ZyxelUsg Flex 50 Firmware>= 4.50, < 5.36
ZyxelUsg Flex 50-
ZyxelUsg Flex 200 Firmware>= 4.50, < 5.36
ZyxelUsg Flex 200-
ZyxelUsg Flex 500 Firmware>= 4.50, < 5.36
ZyxelUsg Flex 500-

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2023-27991?

CVE-2023-27991 is a vulnerability with a CVSS score of 8.8 (HIGH). The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) ...

How severe is CVE-2023-27991?

CVE-2023-27991 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-27991?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Atp200 Firmware, Zyxel Atp200, Zyxel Atp100 Firmware, Zyxel Atp100, Zyxel Atp700 Firmware.