A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the list of trusted RADIUS clients in advance.
History

Wed, 30 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel atp Firmware
Zyxel usg20w-vpn Firmware
Zyxel usg Flex Firmware
Zyxel vpn Firmware
CPEs cpe:2.3:o:zyxel:atp_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn_firmware:*:*:*:*:*:*:*:*
Vendors & Products Zyxel atp Firmware
Zyxel usg20w-vpn Firmware
Zyxel usg Flex Firmware
Zyxel vpn Firmware
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2023-07-17T17:31:40.719Z

Updated: 2024-10-30T18:02:28.372Z

Reserved: 2023-05-26T03:44:51.338Z

Link: CVE-2023-34138

cve-icon Vulnrichment

Updated: 2024-08-02T16:01:54.181Z

cve-icon NVD

Status : Modified

Published: 2023-07-17T18:15:09.540

Modified: 2024-11-21T08:06:37.680

Link: CVE-2023-34138

cve-icon Redhat

No data.