Lucene search

K
cvelistZyxelCVELIST:CVE-2023-35140
HistoryNov 07, 2023 - 1:44 a.m.

CVE-2023-35140

2023-11-0701:44:18
CWE-269
Zyxel
www.cve.org
improper privilege management
zyxel
gs1900-24ep
switch
firmware
vulnerability
authenticated user
read-only access
system settings modification

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware versionΒ V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "GS1900-24EP firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "V2.70(ABTO.5)"
      }
    ]
  }
]

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

Related for CVELIST:CVE-2023-35140