Improper Privilege Management in Zyxel USG FLEX and VPN Series Firmware
CVE-2023-5960

5.5MEDIUM

Key Information:

Vendor

Zyxel
Status
USG FLEX series firmware
VPN series firmware
Vendor
CVE Published:
28 November 2023

What is CVE-2023-5960?

An improper privilege management vulnerability exists within the hotspot feature of Zyxel's USG FLEX and VPN series firmware. This flaw permits an authenticated local attacker to gain unauthorized access to system files on devices running affected firmware versions, specifically from 4.30 to 5.37. Exploiting this vulnerability could result in unauthorized file access, posing a significant risk to the integrity and confidentiality of system information.

Affected Version(s)

USG FLEX series firmware versions 4.50 through 5.37

VPN series firmware versions 4.30 through 5.37

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.