CVE-2023-33012
high-risk
Published 2023-07-17
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.
Do I need to act?
~
8.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
ADJACENT_NETWORK
/ LOW complexity
Affected Products (20)
Usg 20W-Vpn Firmware
Usg 2200-Vpn Firmware
Zywall Atp100 Firmware
Zywall Atp100W Firmware
Zywall Atp200 Firmware
Zywall Atp500 Firmware
Zywall Atp700 Firmware
Zywall Atp800 Firmware
Zywall Vpn100 Firmware
Zywall Vpn2S Firmware
Zywall Vpn300 Firmware
Zywall Vpn50 Firmware
Zywall Vpn 100 Firmware
Affected Vendors
References (2)
57
/ 100
high-risk
Severity
27/34 · High
Exploitability
10/34 · Low
Exposure
20/34 · Moderate