Vulnerability Description
A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Usg 20W-Vpn Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg 20W-Vpn | - |
| Zyxel | Usg 2200-Vpn Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg 2200-Vpn | - |
| Zyxel | Usg Flex 100 Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 100 | - |
| Zyxel | Usg Flex 100W Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 100W | - |
| Zyxel | Usg Flex 200 Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 200 | - |
| Zyxel | Usg Flex 50 Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 50 | - |
| Zyxel | Usg Flex 500 Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 500 | - |
| Zyxel | Usg Flex 50W Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 50W | - |
| Zyxel | Usg Flex 700 Firmware | >= 5.00, < 5.37 |
| Zyxel | Usg Flex 700 | - |
| Zyxel | Zywall Atp100 Firmware | >= 5.00, < 5.37 |
| Zyxel | Zywall Atp100 | - |
Related Weaknesses (CWE)
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisVendor Advisory
FAQ
What is CVE-2023-34141?
CVE-2023-34141 is a vulnerability with a CVSS score of 8.0 (HIGH). A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 P...
How severe is CVE-2023-34141?
CVE-2023-34141 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-34141?
Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Usg 20W-Vpn Firmware, Zyxel Usg 20W-Vpn, Zyxel Usg 2200-Vpn Firmware, Zyxel Usg 2200-Vpn, Zyxel Usg Flex 100 Firmware.