CVE-2023-34139

moderate-risk
Published 2023-07-17

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.

Do I need to act?

-
0.18% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
ADJACENT_NETWORK / LOW complexity

Affected Products (15)

Usg 2200-Vpn Firmware
Zywall Vpn100 Firmware
Zywall Vpn2S Firmware
Zywall Vpn300 Firmware
Zywall Vpn50 Firmware
Zywall Vpn 100 Firmware
Zywall Vpn 300 Firmware
Zywall Vpn 50 Firmware

Affected Vendors

Zyxel

References (2)

Vendor Advisory https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advis...
Vendor Advisory https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advis...
46
/ 100
moderate-risk
Severity 27/34 · High
Exploitability 1/34 · Minimal
Exposure 18/34 · Moderate