CVE Feed

    Dashboard / CVE / CVE-2023-34139

    CVE-2023-34139

    A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.

    Published:Jul 17, 2023
    Last Modified:Nov 21, 2024
    EPS:Jul 17, 2023
    EPSS Score:0.00217
    CVSS Score:8.8

    Affected Products

    Vendor
    Zyxel
    Product
    Usg 2200-vpn
    Vendor
    Zyxel
    Product
    Usg 2200-vpn Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 100
    Vendor
    Zyxel
    Product
    Usg Flex 100 Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 100w
    Vendor
    Zyxel
    Product
    Usg Flex 100w Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 200
    Vendor
    Zyxel
    Product
    Usg Flex 200 Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 50
    Vendor
    Zyxel
    Product
    Usg Flex 500
    Vendor
    Zyxel
    Product
    Usg Flex 500 Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 50 Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 50w
    Vendor
    Zyxel
    Product
    Usg Flex 50w Firmware
    Vendor
    Zyxel
    Product
    Usg Flex 700
    Vendor
    Zyxel
    Product
    Usg Flex 700 Firmware
    Vendor
    Zyxel
    Product
    Usg Flex Firmware
    Vendor
    Zyxel
    Product
    Vpn Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn100
    Vendor
    Zyxel
    Product
    Zywall Vpn100 Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn2s
    Vendor
    Zyxel
    Product
    Zywall Vpn2s Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn300
    Vendor
    Zyxel
    Product
    Zywall Vpn300 Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn50
    Vendor
    Zyxel
    Product
    Zywall Vpn50 Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn 100
    Vendor
    Zyxel
    Product
    Zywall Vpn 100 Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn 300
    Vendor
    Zyxel
    Product
    Zywall Vpn 300 Firmware
    Vendor
    Zyxel
    Product
    Zywall Vpn 50
    Vendor
    Zyxel
    Product
    Zywall Vpn 50 Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-34141 (CVSS 8) — A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware…
    CVE-2023-34140 (CVSS 6.5) — A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX …
    CVE-2023-34138 (CVSS 8) — A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions …
    CVE-2023-33012 (CVSS 8.8) — A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 t…
    CVE-2023-33011 (CVSS 8.8) — A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX se…
    CVE-2023-28767 (CVSS 8.8) — The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.1…
    CVE-2022-2030 (CVSS 6.5) — A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL …
    CVE-2022-30526 (CVSS 7.8) — A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versi…
    CVE-2022-26532 (CVSS 7.8) — A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versi…
    CVE-2022-0910 (CVSS 6.5) — A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zy…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High