Lucene search

[email protected]NVD:CVE-2023-28771

HistoryApr 25, 2023 - 2:15 a.m.

CVE-2023-28771

2023-04-2502:15:08

CWE-78

[email protected]

web.nvd.nist.gov

cve-2023-28771

improper error message handling

zyxel zywall

usg series

vpn series

usg flex series

atp series

remote command execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.884

Percentile

98.8%

JSON

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

Affected configurations

Nvd

Node

zyxelatp100Match-

AND

zyxelatp100_firmwareRange4.60–5.36

Node

zyxelatp100wMatch-

AND

zyxelatp100w_firmwareRange4.60–5.35

Node

zyxelatp200Match-

AND

zyxelatp200_firmwareRange4.60–5.36

Node

zyxelatp500Match-

AND

zyxelatp500_firmwareRange4.60–5.36

Node

zyxelatp700Match-

AND

zyxelatp700_firmwareRange4.60–5.36

Node

zyxelatp800Match-

AND

zyxelatp800_firmwareRange4.60–5.36

Node

zyxelusg_flex_100Match-

AND

zyxelusg_flex_100_firmwareRange4.60–5.36

Node

zyxelusg_flex_100wMatch-

AND

zyxelusg_flex_100w_firmwareRange4.60–5.36

Node

zyxelusg_flex_200_firmwareRange4.60–5.36

AND

zyxelusg_flex_200Match-

Node

zyxelusg_flex_50_firmwareRange4.60–5.36

AND

zyxelusg_flex_50Match-

Node

zyxelusg_flex_500_firmwareRange4.60–5.36

AND

zyxelusg_flex_500Match-

Node

zyxelusg_flex_50w_firmwareRange4.60–5.36

AND

zyxelusg_flex_50wMatch-

Node

zyxelusg_flex_700_firmwareRange4.60–5.36

AND

zyxelusg_flex_700Match-

Node

zyxelvpn100_firmwareRange4.60–5.36

AND

zyxelvpn100Match-

Node

zyxelvpn1000_firmwareRange4.60–5.36

AND

zyxelvpn1000Match-

Node

zyxelvpn300_firmwareRange4.60–5.36

AND

zyxelvpn300Match-

Node

zyxelvpn50_firmwareRange4.60–5.36

AND

zyxelvpn50Match-

Node

zyxelzywall_usg_310_firmwareRange4.60–4.73

zyxelzywall_usg_310_firmwareMatch4.73-

AND

zyxelzywall_usg_310Match-

Node

zyxelzywall_usg_100_firmwareRange4.60–4.73

zyxelzywall_usg_100_firmwareMatch4.73-

AND

zyxelzywall_usg_100Match-

VendorProductVersionCPE
zyxelatp100-cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
zyxelatp100_firmware*cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
zyxelatp100w-cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
zyxelatp100w_firmware*cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
zyxelatp200-cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
zyxelatp200_firmware*cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
zyxelatp500-cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
zyxelatp500_firmware*cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
zyxelatp700-cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
zyxelatp700_firmware*cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zyxel	atp100	-	cpe:2.3:h:zyxel:atp100:-:::::::*
zyxel	atp100_firmware	*	cpe:2.3:o:zyxel:atp100_firmware::::::::
zyxel	atp100w	-	cpe:2.3:h:zyxel:atp100w:-:::::::*
zyxel	atp100w_firmware	*	cpe:2.3:o:zyxel:atp100w_firmware::::::::
zyxel	atp200	-	cpe:2.3:h:zyxel:atp200:-:::::::*
zyxel	atp200_firmware	*	cpe:2.3:o:zyxel:atp200_firmware::::::::
zyxel	atp500	-	cpe:2.3:h:zyxel:atp500:-:::::::*
zyxel	atp500_firmware	*	cpe:2.3:o:zyxel:atp500_firmware::::::::
zyxel	atp700	-	cpe:2.3:h:zyxel:atp700:-:::::::*
zyxel	atp700_firmware	*	cpe:2.3:o:zyxel:atp700_firmware::::::::