34 results (0.009 seconds)

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-9677

https://notcve.org/view.php?id=CVE-2024-9677

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024 • CWE-522: Insufficiently Protected Credentials •

CVSS: 5.5EPSS: 0%CPEs: 61EXPL: 0

CVE-2023-5797

https://notcve.org/view.php?id=CVE-2023-5797

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device. Una vulnerabilidad de administración de privilegios inadecuada en el comando CLI de depuración de las versiones de firmware: serie Zyxel ATP 4.32 a 5.37, serie USG FLEX 4.50 a 5.37, serie USG FLEX 50(W) 4.16 a 5.37, serie USG20(W)-VPN 4.16 a 5.37, serie VPN 4.30 a 5.37, NWA50AX 6.29 (ABYW.2), WAC500 6.65 (ABVS.1), WAX300H 6.60 (ACHF.1) y WBE660S 6.65 ( ACGG.1),. Podría permitir que un atacante local autenticado acceda a los registros del administrador en un dispositivo afectado. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps • CWE-269: Improper Privilege Management •

CVSS: 5.5EPSS: 0%CPEs: 61EXPL: 0

CVE-2023-37925

https://notcve.org/view.php?id=CVE-2023-37925

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device. Una vulnerabilidad de administración de privilegios inadecuada en el comando CLI de depuración de las versiones de firmware: serie Zyxel ATP 4.32 a 5.37, serie USG FLEX 4.50 a 5.37, serie USG FLEX 50(W) 4.16 a 5.37, serie USG20(W)-VPN 4.16 a 5.37, serie VPN 4.30 a 5.37, NWA50AX 6.29 (ABYW.2), WAC500 6.65 (ABVS.1), WAX300H 6.60 (ACHF.1) y WBE660S 6.65 ( ACGG.1). Podría permitir que un atacante local autenticado acceda a los archivos del sistema en un dispositivo afectado. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps • CWE-269: Improper Privilege Management •

CVSS: 8.0EPSS: 0%CPEs: 48EXPL: 0

CVE-2023-34141

https://notcve.org/view.php?id=CVE-2023-34141

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 6.5EPSS: 0%CPEs: 48EXPL: 0

CVE-2023-34140

https://notcve.org/view.php?id=CVE-2023-34140

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to cause denial of service (DoS) conditions by sending a crafted request to the CAPWAP daemon. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •