CVE-2023-27990 — Zyxel / ATP series firmware

Description (CNA)

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

Affected (CNA)

Vendor / product	Versions
Zyxel / ATP series firmware	affected 4.32 through 5.35
Zyxel / USG FLEX series firmware	affected 4.50 through 5.35
Zyxel / USG FLEX 50(W) firmware	affected 4.16 through 5.35
Zyxel / USG20(W)-VPN firmware	affected 4.16 through 5.35
Zyxel / VPN series firmware	affected 4.30 through 5.35

CWE

CWE-79

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls

ADP enrichment

CVE

No English description supplied.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls