CVE-2023-35139

🗓️ 28 Nov 2023 01:22:07Reported by ZyxelType

A cross-site scripting (XSS) vulnerability in Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series firmware versions 5.10-5.37 allows storing malicious scripts, leading to cookie theft

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of the Common Gateway Interface (CGI) interface of ZyXEL VPN, USG FLEX, and ATP microprogramming devices allows attackers to carry out cross-site scripting attacks and gain unauthorized access to protected information.	1 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-35139	17 Dec 202312:12	–	circl
CNNVD	Zyxel ATP Cross-Site Scripting Vulnerability	28 Nov 202300:00	–	cnnvd
Cvelist	CVE-2023-35139	28 Nov 202301:22	–	cvelist
EUVD	EUVD-2023-39169	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Zyxel products	4 Dec 202300:00	–	ncsc
NVD	CVE-2023-35139	28 Nov 202302:15	–	nvd
OSV	CVE-2023-35139	28 Nov 202302:15	–	osv
Prion	Cross site scripting	28 Nov 202302:15	–	prion
Positive Technologies	PT-2023-7249 · Zyxel · Zyxel Usg Flex Series +4	14 Jun 202300:00	–	ptsecurity

NVD

Node

zyxel zldRange5.10–5.37

AND

zyxel atp100Match-

zyxel atp100wMatch-

zyxel atp200Match-

zyxel atp500Match-

zyxel atp700Match-

zyxel atp800Match-

Node

zyxel zldRange5.00–5.37

AND

zyxel usg_flex_100Match-

zyxel usg_flex_100wMatch-

zyxel usg_flex_200Match-

zyxel usg_flex_50Match-

zyxel usg_flex_500Match-

zyxel usg_flex_50wMatch-

zyxel usg_flex_700Match-

Node

zyxel zldRange5.10–5.37

AND

zyxel usg_20w-vpnMatch-

zyxel vpn50wMatch-

Node

zyxel zldRange5.00–5.37

AND

zyxel vpn100Match-

zyxel vpn1000Match-

zyxel vpn300Match-

zyxel vpn50Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "ATP series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions 5.10 through 5.37"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "USG FLEX series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": " versions 5.00 through 5.37"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": " USG FLEX 50(W) series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions 5.10 through 5.37"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "USG20(W)-VPN series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": " versions 5.10 through 5.37"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "VPN series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "versions 5.00 through 5.37"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps

17 Jun 2026 06:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.2 - 6.1

EPSS0.00462

CWE-79