Command Injection Vulnerability in Zyxel ATP and USG FLEX Series Firmware

CVE-2023-34141

Summary

A command injection vulnerability exists in the access point management functionality of Zyxel's firmware, affecting several product lines. An attacker on the local network can exploit this flaw to execute arbitrary OS commands on targeted devices by manipulating the managed AP list, contingent upon convincing an authorized administrator to add their IP address. This highlights the importance of stringent access controls and vigilance in network management practices to safeguard against potential exploits.

References