Improper Privilege Management in Zyxel ATP and USG FLEX Products
CVE-2023-37925

5.5MEDIUM

Key Information:

Vendor

Zyxel
Status
ATP series firmware
USG FLEX series firmware
USG FLEX 50(W) series firmware
USG20(W)-VPN series firmware
Vendor
CVE Published:
28 November 2023

What is CVE-2023-37925?

The vulnerability presents an improper privilege management issue within the debug CLI command of specific Zyxel firmware versions. This flaw could potentially allow authenticated local attackers to access sensitive system files on the affected devices, exposing critical data and control mechanisms.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ATP series firmware versions 4.32 through 5.37

NWA50AX firmware 6.29(ABYW.2)

USG FLEX 50(W) series firmware versions 4.16 through 5.37

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.