Lucene search

PRIOn knowledge basePRION:CVE-2023-35140

HistoryNov 07, 2023 - 5:15 a.m.

Privilege escalation

2023-11-0705:15:00

PRIOn knowledge base

www.prio-n.com

privilege escalation

vulnerability

zyxel gs1900-24ep

firmware

authenticated user

system settings

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

CPENameOperatorVersion
gs1900-10hp_firmwareeq<= 2.70aazi.5
gs1900-16_firmwareeq<= 2.70aahj.5
gs1900-24_firmwareeq<= 2.70aahl.5
gs1900-24e_firmwareeq<= 2.70aahk.5
gs1900-24ep_firmwareeq<= 2.70abto.5
gs1900-24hpv2_firmwareeq<= 2.70abtp.5
gs1900-48_firmwareeq<= 2.70aahn.5
gs1900-48hpv2_firmwareeq<= 2.70abtq.5
gs1900-8_firmwareeq<= 2.70aahh.5
gs1900-8hp_firmwareeq<= 2.70aahi.5

Name	Operator	Version
gs1900-10hp_firmware	eq	<= 2.70aazi.5
gs1900-16_firmware	eq	<= 2.70aahj.5
gs1900-24_firmware	eq	<= 2.70aahl.5
gs1900-24e_firmware	eq	<= 2.70aahk.5
gs1900-24ep_firmware	eq	<= 2.70abto.5
gs1900-24hpv2_firmware	eq	<= 2.70abtp.5
gs1900-48_firmware	eq	<= 2.70aahn.5
gs1900-48hpv2_firmware	eq	<= 2.70abtq.5
gs1900-8_firmware	eq	<= 2.70aahh.5
gs1900-8hp_firmware	eq	<= 2.70aahi.5

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:S/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for PRION:CVE-2023-35140