Lucene search

PRIOn knowledge basePRION:CVE-2023-5797

HistoryNov 28, 2023 - 3:15 a.m.

Privilege escalation

2023-11-2803:15:00

PRIOn knowledge base

www.prio-n.com

privilege escalation

cli command

zyxel atp

usg flex

usg20(w)-vpn

nwa50ax

wac500

wax300h

wbe660s

vulnerability

administrator logs

authenticated attacker

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device.

CPENameOperatorVersion
nwa110ax_firmwareeq< 6.70abtg.0
nwa1123acv3_firmwareeq< 6.70abvt.0
nwa210ax_firmwareeq< 6.70abtd.0
nwa220ax-6e_firmwareeq< 6.70acco.0
nwa50ax-pro_firmwareeq< 6.80acge.0
nwa50ax_firmwareeq< 6.80abyw.0
nwa55axe_firmwareeq< 6.80abzl.0
nwa90ax-pro_firmwareeq< 6.80acgf.0
nwa90ax_firmwareeq< 6.80accv.0
wac500_firmwareeq< 6.70abvs.0

Name	Operator	Version
nwa110ax_firmware	eq	< 6.70abtg.0
nwa1123acv3_firmware	eq	< 6.70abvt.0
nwa210ax_firmware	eq	< 6.70abtd.0
nwa220ax-6e_firmware	eq	< 6.70acco.0
nwa50ax-pro_firmware	eq	< 6.80acge.0
nwa50ax_firmware	eq	< 6.80abyw.0
nwa55axe_firmware	eq	< 6.80abzl.0
nwa90ax-pro_firmware	eq	< 6.80acgf.0
nwa90ax_firmware	eq	< 6.80accv.0
wac500_firmware	eq	< 6.70abvs.0

Rows per page:

1-10 of 271

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for PRION:CVE-2023-5797