CVE-2023-27990

Description

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

CVSS 3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.34% probability · 27th percentile

CISA KEV

Not listed

Weakness

CWE-79

Affected

zyxel/atp200 firmware · zyxel/atp100 firmware · zyxel/atp700 firmware · zyxel/atp500 firmware · zyxel/atp100w firmware · zyxel/atp800 firmware · zyxel/usg flex 100 firmware · zyxel/usg flex 50 firmware · zyxel/usg flex 200 firmware · zyxel/usg flex 500 firmware · zyxel/usg flex 700 firmware · zyxel/usg flex 100w firmware · zyxel/usg 20w-vpn firmware · zyxel/usg flex 50w firmware · zyxel/usg20-vpn firmware · zyxel/vpn100 firmware · zyxel/vpn1000 firmware · zyxel/vpn300 firmware · zyxel/vpn50 firmware

Source

security@zyxel.com.tw

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.