NetSight
IP …
high7.2

CVE-2023-6398

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX …

Impact

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

Affected products

VendorProductAffected versions
ZyxelAtp100 Firmware
from 4.32 before 5.37
Version 5.37
ZyxelAtp100w Firmware
from 4.32 before 5.37
Version 5.37
ZyxelAtp200 Firmware
from 4.32 before 5.37
Version 5.37
ZyxelAtp500 Firmware
from 4.32 before 5.37
Version 5.37
ZyxelAtp700 Firmware
from 4.32 before 5.37
Version 5.37
ZyxelAtp800 Firmware
from 4.32 before 5.37
Version 5.37
ZyxelUsg Flex 100 Firmware
from 4.50 before 5.37
Version 5.37
ZyxelUsg Flex 100ax Firmware
from 4.50 before 5.37
Version 5.37
ZyxelUsg Flex 100h Firmware
from 4.50 before 5.37
Version 5.37
ZyxelUsg Flex 100w Firmware
from 4.50 before 5.37
Version 5.37
ZyxelUsg Flex 200 Firmware
from 4.50 before 5.37
Version 5.37
ZyxelUsg Flex 200h Firmware
from 4.50 before 5.37
Version 5.37

Weakness classification

CWE-78

References