CVE-2023-22918

CWE-3593 documents3 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 48.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
56
Zyxel Atp100 FirmwareZyxel Atp100w FirmwareZyxel Atp200 Firmware+53 more
Timeline
PublishedApr 24

Description

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) an…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages59 packages

▶CVEListV5zyxel/usg_flex_series_firmware4.50 through 5.35
▶CVEListV5zyxel/atp_series_firmware4.32 through 5.35
▶CVEListV5zyxel/vpn_series_firmware4.30 through 5.35
▶NVDzyxel/usg_flex_50_firmware4.50 — 5.36
▶NVDzyxel/usg_flex_100_firmware4.50 — 5.36

Patches

Patch: www.zyxel.com ↗Patch: www.zyxel.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-q9h2-893q-85gq: A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4↗2023-04-24
▶
CVEList
CVE-2023-22918: A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4↗2023-04-24
▶