HIGH · 8.0

CVE-2023-34141

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 P...

Vulnerability Description

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.

CVSS Score

8.0

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ZyxelUsg 20W-Vpn Firmware>= 5.00, < 5.37
ZyxelUsg 20W-Vpn-
ZyxelUsg 2200-Vpn Firmware>= 5.00, < 5.37
ZyxelUsg 2200-Vpn-
ZyxelUsg Flex 100 Firmware>= 5.00, < 5.37
ZyxelUsg Flex 100-
ZyxelUsg Flex 100W Firmware>= 5.00, < 5.37
ZyxelUsg Flex 100W-
ZyxelUsg Flex 200 Firmware>= 5.00, < 5.37
ZyxelUsg Flex 200-
ZyxelUsg Flex 50 Firmware>= 5.00, < 5.37
ZyxelUsg Flex 50-
ZyxelUsg Flex 500 Firmware>= 5.00, < 5.37
ZyxelUsg Flex 500-
ZyxelUsg Flex 50W Firmware>= 5.00, < 5.37
ZyxelUsg Flex 50W-
ZyxelUsg Flex 700 Firmware>= 5.00, < 5.37
ZyxelUsg Flex 700-
ZyxelZywall Atp100 Firmware>= 5.00, < 5.37
ZyxelZywall Atp100-

Related Weaknesses (CWE)

References

FAQ

What is CVE-2023-34141?

CVE-2023-34141 is a vulnerability with a CVSS score of 8.0 (HIGH). A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 P...

How severe is CVE-2023-34141?

CVE-2023-34141 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-34141?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Usg 20W-Vpn Firmware, Zyxel Usg 20W-Vpn, Zyxel Usg 2200-Vpn Firmware, Zyxel Usg 2200-Vpn, Zyxel Usg Flex 100 Firmware.