CVE-2023-27991

🗓️ 24 Apr 2023 00:00:00Reported by ZyxelType

CVE-2023-27991 Zyxel ATP, USG FLEX, and USG20(W)-VPN firmware versions 4.32-5.35 CLI command injection vuln

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of microprogrammed network devices such as ZyXEL USG, USG FLEX, ATP, and VPN lies in the lack of protective measures for the website structure. This allows attackers to execute arbitrary scripts on the vulnerable device.	19 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-27991	24 Apr 202322:19	–	circl
CNNVD	Zyxel ATP 操作系统命令注入漏洞	24 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-27991	24 Apr 202300:00	–	cvelist
EUVD	EUVD-2023-31716	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Zyxel Firewalls and Access Points	25 Apr 202300:00	–	ncsc
NVD	CVE-2023-27991	24 Apr 202318:15	–	nvd
OSV	CVE-2023-27991	24 Apr 202318:15	–	osv
Prion	Command injection	24 Apr 202318:15	–	prion
Positive Technologies	PT-2023-7789 · Zyxel · Zyxel Usg Flex Series +4	24 Apr 202300:00	–	ptsecurity

NVD

Node

AND

zyxel atp200_firmwareRange4.32–5.36

zyxel atp200Match-

Node

AND

zyxel atp100_firmwareRange4.32–5.36

zyxel atp100Match-

Node

AND

zyxel atp700_firmwareRange4.32–5.36

zyxel atp700Match-

Node

AND

zyxel atp500_firmwareRange4.32–5.36

zyxel atp500Match-

Node

AND

zyxel atp100w_firmwareRange4.32–5.36

zyxel atp100wMatch-

Node

AND

zyxel atp800_firmwareRange4.32–5.36

zyxel atp800Match-

Node

AND

zyxel usg_flex_100_firmwareRange4.50–5.36

zyxel usg_flex_100Match-

Node

AND

zyxel usg_flex_50_firmwareRange4.50–5.36

zyxel usg_flex_50Match-

Node

AND

zyxel usg_flex_200_firmwareRange4.50–5.36

zyxel usg_flex_200Match-

Node

AND

zyxel usg_flex_500_firmwareRange4.50–5.36

zyxel usg_flex_500Match-

Node

AND

zyxel usg_flex_700_firmwareRange4.50–5.36

zyxel usg_flex_700Match-

Node

AND

zyxel usg_flex_100w_firmwareRange4.50–5.36

zyxel usg_flex_100wMatch-

Node

AND

zyxel usg_20w-vpn_firmwareRange4.16–5.36

zyxel usg_20w-vpnMatch-

Node

AND

zyxel usg_flex_50w_firmwareRange4.16–5.36

zyxel usg_flex_50wMatch-

Node

AND

zyxel usg20-vpn_firmwareRange4.30–5.36

zyxel usg20-vpnMatch-

Node

AND

zyxel vpn100_firmwareRange4.30–5.36

zyxel vpn100Match-

Node

AND

zyxel vpn1000_firmwareRange4.30–5.36

zyxel vpn1000Match-

Node

AND

zyxel vpn300_firmwareRange4.30–5.36

zyxel vpn300Match-

Node

AND

zyxel vpn50_firmwareRange4.30–5.36

zyxel vpn50Match-

[
  {
    "vendor": "Zyxel",
    "product": "ATP series firmware",
    "versions": [
      {
        "version": "4.32 through 5.35",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "USG FLEX series firmware",
    "versions": [
      {
        "version": "4.50 through 5.35",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "USG FLEX 50(W) firmware",
    "versions": [
      {
        "version": "4.16 through 5.35",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "USG20(W)-VPN firmware",
    "versions": [
      {
        "version": "4.16 through 5.35",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "VPN series firmware",
    "versions": [
      {
        "version": "4.30 through 5.35",
        "status": "affected"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls

17 Jun 2026 05:46Current

9.2High risk

Vulners AI Score9.2

CVSS 3.18.8

EPSS0.01508

SSVC

CWE-78