medium4.8
CVE-2023-27990
The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG …
Impact
The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Atp200 Firmware | from 4.32 before 5.36 |
| Zyxel | Atp100 Firmware | from 4.32 before 5.36 |
| Zyxel | Atp700 Firmware | from 4.32 before 5.36 |
| Zyxel | Atp500 Firmware | from 4.32 before 5.36 |
| Zyxel | Atp100w Firmware | from 4.32 before 5.36 |
| Zyxel | Atp800 Firmware | from 4.32 before 5.36 |
| Zyxel | Usg Flex 100 Firmware | from 4.50 before 5.36 |
| Zyxel | Usg Flex 50 Firmware | from 4.50 before 5.36 |
| Zyxel | Usg Flex 200 Firmware | from 4.50 before 5.36 |
| Zyxel | Usg Flex 500 Firmware | from 4.50 before 5.36 |
| Zyxel | Usg Flex 700 Firmware | from 4.50 before 5.36 |
| Zyxel | Usg Flex 100w Firmware | from 4.50 before 5.36 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls