CVE-2023-6398 — Zyxel / ATP series firmware

Description (CNA)

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

Affected (CNA)

Vendor / product	Versions
Zyxel / ATP series firmware	affected version 4.32 through 5.37 Patch 1
Zyxel / USG FLEX series firmware	affected version 4.50 through 5.37 Patch 1
Zyxel / USG FLEX 50(W) series firmware	affected version 4.16 through 5.37 Patch 1
Zyxel / USG20(W)-VPN series firmware	affected version 4.16 through 5.37 Patch 1
Zyxel / NWA50AX firmware	affected < 6.29(ABYW.4)
Zyxel / WAC500 firmware	affected < 6.70(ABVS.1)
Zyxel / WAX300H firmware	affected < 6.70(ACHF.1)
Zyxel / WBE660S firmware	affected < 6.70(ACGG.1)
Zyxel / USG FLEX H series firmware	affected version 1.10 through 1.10 Patch 1

CWE

CWE-78

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024

ADP enrichment

CVE

No English description supplied.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024

CISA-ADP

No English description supplied.

No references supplied.