VulnerabilityAnalyzed

CVE-2023-6398

HIGH 7.2EPSS 1.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.33% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: zyxel/atp100 firmware · zyxel/atp100w firmware · zyxel/atp200 firmware · zyxel/atp500 firmware · zyxel/atp700 firmware · zyxel/atp800 firmware · zyxel/usg flex 100 firmware · zyxel/usg flex 100ax firmware · zyxel/usg flex 100h firmware · zyxel/usg flex 100w firmware · zyxel/usg flex 200 firmware · zyxel/usg flex 200h firmware · zyxel/usg flex 200hp firmware · zyxel/usg flex 50 firmware · zyxel/usg flex 500 firmware · zyxel/usg flex 500h firmware · zyxel/usg flex 50w firmware · zyxel/usg flex 700 firmware · zyxel/usg flex 700h firmware · zyxel/usg20-vpn firmware · +22 more
Source: security@zyxel.com.tw

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.