Details of VAR-202304-2073

ID

VAR-202304-2073

CVE

CVE-2023-28771

TITLE

Zyxel ZyWALL USG Operating system command injection vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202304-1976

DESCRIPTION

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device

Trust: 0.99

sources: NVD: CVE-2023-28771 // VULMON: CVE-2023-28771

AFFECTED PRODUCTS

vendor:	zyxel	model:	usg flex 100w	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 50w	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp500	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	zywall usg 100	scope:	eq	version:	4.73	Trust: 1.0
vendor:	zyxel	model:	atp700	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp700	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 500	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp100	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp500	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	zywall usg 310	scope:	eq	version:	4.73	Trust: 1.0
vendor:	zyxel	model:	usg flex 500	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	zywall usg 100	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp100	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	vpn300	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp100w	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	vpn100	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	vpn300	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	zywall usg 310	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp200	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp200	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	vpn1000	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	usg flex 50	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	usg flex 100	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	usg flex 50	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 100	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	zywall usg 100	scope:	lt	version:	4.73	Trust: 1.0
vendor:	zyxel	model:	usg flex 700	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	vpn100	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	vpn1000	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	vpn50	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	usg flex 100w	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	atp800	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	vpn50	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp800	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 50w	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	usg flex 700	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 200	scope:	lt	version:	5.36	Trust: 1.0
vendor:	zyxel	model:	zywall usg 310	scope:	lt	version:	4.73	Trust: 1.0
vendor:	zyxel	model:	usg flex 200	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp100w	scope:	lt	version:	5.35	Trust: 1.0

sources: NVD: CVE-2023-28771

CVSS

SEVERITY

CVSSV2

CVSSV3

security@zyxel.com.tw:	CVE-2023-28771
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2023-28771
value:	CRITICAL
Trust: 1.0
CNNVD:	CNNVD-202304-1976
value:	CRITICAL
Trust: 0.6

security@zyxel.com.tw:
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 2.0

sources: NVD: CVE-2023-28771 // NVD: CVE-2023-28771 // CNNVD: CNNVD-202304-1976

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.0

sources: NVD: CVE-2023-28771

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202304-1976

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202304-1976

CONFIGURATIONS

sources: NVD: CVE-2023-28771

PATCH

title:

Zyxel ZyWALL USG Fixes for operating system command injection vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=234820

Trust: 0.6

sources: CNNVD: CNNVD-202304-1976

EXTERNAL IDS

db:	NVD	id:	CVE-2023-28771	Trust: 1.7
db:	PACKETSTORM	id:	172820	Trust: 1.6
db:	CNNVD	id:	CNNVD-202304-1976	Trust: 0.6
db:	VULMON	id:	CVE-2023-28771	Trust: 0.1

sources: VULMON: CVE-2023-28771 // NVD: CVE-2023-28771 // CNNVD: CNNVD-202304-1976

REFERENCES

url:	https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls	Trust: 1.7
url:	http://packetstormsecurity.com/files/172820/zyxel-ike-packet-decoder-unauthenticated-remote-code-execution.html	Trust: 1.6
url:	https://cxsecurity.com/cveshow/cve-2023-28771/	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2023-28771	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-28771 // NVD: CVE-2023-28771 // CNNVD: CNNVD-202304-1976

SOURCES

db:	VULMON	id:	CVE-2023-28771
db:	NVD	id:	CVE-2023-28771
db:	CNNVD	id:	CNNVD-202304-1976

LAST UPDATE DATE

2023-12-18T13:59:09.508000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-28771	date:	2023-04-25T00:00:00
db:	NVD	id:	CVE-2023-28771	date:	2023-06-09T18:12:04.557
db:	CNNVD	id:	CNNVD-202304-1976	date:	2023-06-12T00:00:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-28771	date:	2023-04-25T00:00:00
db:	NVD	id:	CVE-2023-28771	date:	2023-04-25T02:15:08.743
db:	CNNVD	id:	CNNVD-202304-1976	date:	2023-04-24T00:00:00