1. Home
  2. CVE Database
  3. CVE-2023-5960
MEDIUM · 5.5

CVE-2023-5960

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an...

Vulnerability Description

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ZyxelZld>= 4.50, <= 5.37
ZyxelUsg Flex 100-
ZyxelUsg Flex 100W-
ZyxelUsg Flex 200-
ZyxelUsg Flex 50-
ZyxelUsg Flex 500-
ZyxelUsg Flex 50W-
ZyxelUsg Flex 700-
ZyxelVpn100-
ZyxelVpn1000-
ZyxelVpn300-
ZyxelVpn50-

Related Weaknesses (CWE)

CWE-269

References

FAQ

What is CVE-2023-5960?

CVE-2023-5960 is a vulnerability with a CVSS score of 5.5 (MEDIUM). An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an...

How severe is CVE-2023-5960?

CVE-2023-5960 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-5960?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Zld, Zyxel Usg Flex 100, Zyxel Usg Flex 100W, Zyxel Usg Flex 200, Zyxel Usg Flex 50.