Lucene search

[email protected]NVD:CVE-2023-27990

HistoryApr 24, 2023 - 6:15 p.m.

CVE-2023-27990

2023-04-2418:15:09

CWE-79

[email protected]

web.nvd.nist.gov

zyxel atp

usg flex

xss vulnerability

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

Affected configurations

Nvd

Node

zyxelatp200Match-

AND

zyxelatp200_firmwareRange4.32–5.36

Node

zyxelatp100_firmwareRange4.32–5.36

AND

zyxelatp100Match-

Node

zyxelatp700_firmwareRange4.32–5.36

AND

zyxelatp700Match-

Node

zyxelatp500_firmwareRange4.32–5.36

AND

zyxelatp500Match-

Node

zyxelatp100w_firmwareRange4.32–5.36

AND

zyxelatp100wMatch-

Node

zyxelatp800_firmwareRange4.32–5.36

AND

zyxelatp800Match-

Node

zyxelusg_flex_100_firmwareRange4.50–5.36

AND

zyxelusg_flex_100Match-

Node

zyxelusg_flex_50_firmwareRange4.50–5.36

AND

zyxelusg_flex_50Match-

Node

zyxelusg_flex_200_firmwareRange4.50–5.36

AND

zyxelusg_flex_200Match-

Node

zyxelusg_flex_500_firmwareRange4.50–5.36

AND

zyxelusg_flex_500Match-

Node

zyxelusg_flex_700_firmwareRange4.50–5.36

AND

zyxelusg_flex_700Match-

Node

zyxelusg_flex_100w_firmwareRange4.50–5.36

AND

zyxelusg_flex_100wMatch-

Node

zyxelusg_20w-vpn_firmwareRange4.16–5.36

AND

zyxelusg_20w-vpnMatch-

Node

zyxelusg_flex_50w_firmwareRange4.16–5.36

AND

zyxelusg_flex_50wMatch-

Node

zyxelusg20-vpn_firmwareRange4.30–5.36

AND

zyxelusg20-vpnMatch-

Node

zyxelvpn100_firmwareRange4.30–5.36

AND

zyxelvpn100Match-

Node

zyxelvpn1000_firmwareRange4.30–5.36

AND

zyxelvpn1000Match-

Node

zyxelvpn300_firmwareRange4.30–5.36

AND

zyxelvpn300Match-

Node

zyxelvpn50_firmwareRange4.30–5.36

AND

zyxelvpn50Match-

VendorProductVersionCPE
zyxelatp200-cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
zyxelatp200_firmware*cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
zyxelatp100_firmware*cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
zyxelatp100-cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
zyxelatp700_firmware*cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
zyxelatp700-cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
zyxelatp500_firmware*cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
zyxelatp500-cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
zyxelatp100w_firmware*cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
zyxelatp100w-cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zyxel	atp200	-	cpe:2.3:h:zyxel:atp200:-:::::::*
zyxel	atp200_firmware	*	cpe:2.3:o:zyxel:atp200_firmware::::::::
zyxel	atp100_firmware	*	cpe:2.3:o:zyxel:atp100_firmware::::::::
zyxel	atp100	-	cpe:2.3:h:zyxel:atp100:-:::::::*
zyxel	atp700_firmware	*	cpe:2.3:o:zyxel:atp700_firmware::::::::
zyxel	atp700	-	cpe:2.3:h:zyxel:atp700:-:::::::*
zyxel	atp500_firmware	*	cpe:2.3:o:zyxel:atp500_firmware::::::::
zyxel	atp500	-	cpe:2.3:h:zyxel:atp500:-:::::::*
zyxel	atp100w_firmware	*	cpe:2.3:o:zyxel:atp100w_firmware::::::::
zyxel	atp100w	-	cpe:2.3:h:zyxel:atp100w:-:::::::*

Rows per page:

1-10 of 381

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

17.5%

JSON

Related for NVD:CVE-2023-27990

cvelist1 cve1 prion1