high8.8
CVE-2023-34139
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series…
Impact
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Usg 2200-Vpn Firmware | from 4.20 before 5.37 |
| Zyxel | Usg Flex 100 Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 100w Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 200 Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 50 Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 500 Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 50w Firmware | from 4.50 before 5.37 |
| Zyxel | Usg Flex 700 Firmware | from 4.50 before 5.37 |
| Zyxel | Zywall Vpn100 Firmware | from 4.20 before 5.37 |
| Zyxel | Zywall Vpn2s Firmware | from 4.20 before 5.37 |
| Zyxel | Zywall Vpn300 Firmware | from 4.20 before 5.37 |
| Zyxel | Zywall Vpn50 Firmware | from 4.20 before 5.37 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers