ByteOS Network

Vulnerability Details :

CVE-2023-22916

Assigner-Zyxel

Assigner Org ID-96e50032-ad0d-4058-a115-4d2c13821f9f

Published At-24 Apr, 2023 | 00:00

Updated At-12 Feb, 2025 | 16:42

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Zyxel

Assigner Org ID:96e50032-ad0d-4058-a115-4d2c13821f9f

Published At:24 Apr, 2023 | 00:00

Updated At:12 Feb, 2025 | 16:42

▼CVE Numbering Authority (CNA)

5.00 through 5.35

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20: Improper Input Validation

Type: CWE

CWE ID: CWE-20

Description: CWE-20: Improper Input Validation

Metrics

Version	Base score	Base severity	Vector
3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

Hyperlink	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps	N/A

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps	x_transferred

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@zyxel.com.tw

Published At:24 Apr, 2023 | 17:15

Updated At:04 May, 2023 | 19:35

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Secondary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CPE Matches

Zyxel Networks Corporation

>>usg_flex_100_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_100>>-

cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_100w_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_100w>>-

cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_200_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_200>>-

cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_50_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_50>>-

cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_50w_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_50w>>-

cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_500_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_500>>-

cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_700_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_flex_700>>-

cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn100_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn100>>-

cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn1000_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn1000>>-

cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn300_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn300>>-

cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn50_firmware>>Versions from 5.00(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>vpn50>>-

cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_20w-vpn_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>usg_20w-vpn>>-

cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp100_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp100>>-

cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp100w_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp100w>>-

cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp200_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp200>>-

cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp500_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp500>>-

cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp700_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp700>>-

cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp800_firmware>>Versions from 5.10(inclusive) to 5.35(inclusive)

cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*

Zyxel Networks Corporation

>>atp800>>-

cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-20	Secondary	security@zyxel.com.tw

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-20

Type: Secondary

Source: security@zyxel.com.tw

References

Hyperlink	Source	Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps	security@zyxel.com.tw	Vendor Advisory

Hyperlink: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps

Source: security@zyxel.com.tw

Resource:

Vendor Advisory

Similar CVEs

5Records found

CVE-2013-3588

Matching Score-6

Assigner-CERT/CC

View Details

Matching Score-6

Assigner-CERT/CC

CVSS Score-7.8||HIGH

EPSS-0.47% / 63.68%

7 Day CHG~0.00%

Published-02 Apr, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

The web management interface on Zyxel P660 devices allows remote attackers to cause a denial of service (reboot) via a flood of TCP SYN packets.

Vendor-n/a Zyxel Networks Corporation

Product-p-660h-t1 p-660hw_t3 p-660h-63 p-660h-t3 p-660h-d3 p-660h-d1 p-660h-61 p-660hw_d3 p-660hw_d1 p-660hw p-660h-67 n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2023-35136

Matching Score-6

Assigner-Zyxel Corporation

View Details

Matching Score-6

Assigner-Zyxel Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.11% / 30.28%

7 Day CHG~0.00%

Published-28 Nov, 2023 | 01:16

Updated-05 Jun, 2025 | 13:54

An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to access configuration files on an affected device.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-6260

Matching Score-6

Assigner-Cisco Systems, Inc.

View Details

Matching Score-6

Assigner-Cisco Systems, Inc.

CVSS Score-7.5||HIGH

EPSS-0.37% / 58.02%

7 Day CHG~0.00%

Published-03 Mar, 2016 | 22:00

Updated-12 Apr, 2025 | 10:46

Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.

Vendor-n/a Cisco Systems, Inc.Zyxel Networks Corporation

Product-nexus_5596up gs1900-10hp_firmware nexus_5672up nexus_5548p nexus_5648q nexus_5696q nexus_5548up nexus_5596t nexus_5624q nexus_56128p n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2014-7278

Matching Score-6

Assigner-MITRE Corporation

View Details

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5||MEDIUM

EPSS-0.69% / 70.79%

7 Day CHG~0.00%

Published-04 Oct, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to cause a denial of service (persistent web-interface outage) via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginMsg variable's value, a different vulnerability than CVE-2014-7277.

Vendor-n/a Zyxel Networks Corporation

Product-sbg3300-n sbg3300-n_firmware n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2022-26531

Matching Score-6

Assigner-Zyxel Corporation

View Details

Matching Score-6

Assigner-Zyxel Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.99% / 75.93%

7 Day CHG~0.00%

Published-24 May, 2022 | 00:00

Updated-03 Aug, 2024 | 05:03

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

Vendor-Zyxel Networks Corporation

Product-usg_60w_firmware nwa210ax_firmware wac6502d-e_firmware atp100 atp800_firmware usg_2200-vpn_firmware usg_flex_100 atp100w_firmware nwa1302-ac_firmware nap303_firmware nxc2500 nsg300 nwa1123-ac-pro_firmware nwa110ax_firmware usg300_firmware wax510d_firmware usg200 usg_40w nwa90ax_firmware nsg100 atp500_firmware usg_20w-vpn_firmware wac6502d-e atp800 nap203_firmware vpn50 usg310 wac6103d-i usg_40w_firmware wac5302d-sv2 nwa1123-ac-pro wac6502d-s_firmware wac6552d-s wac5302d-sv2_firmware nap203 wax650s usg2200 wax610d_firmware atp200_firmware nwa55axe_firmware wac500h nsg300_firmware atp100_firmware usg_flex_500_firmware nwa50ax wax610d nsg100_firmware usg200_firmware wac6552d-s_firmware vpn300 usg_flex_100w wac500 usg_110_firmware atp700_firmware usg_60w usg210 nap353 nsg50 wax650s_firmware usg_110 usg_1900_firmware atp500 wac6103d-i_firmware nwa1123acv3_firmware usg_40 vpn300_firmware wax630s nwa5123-ac-hd_firmware nwa50ax_firmware usg_1900 wac500h_firmware nwa1123-ac-hd usg_flex_100w_firmware nap303 usg_2200-vpn vpn50_firmware atp200 atp700 usg_20w usg_20w-vpn nwa1302-ac vpn1000_firmware wac6553d-s wac5302d-s_firmware wac5302d-s nwa110ax usg_flex_500 usg310_firmware usg20 usg_310 vpn100 usg_1100 usg_310_firmware nsg50_firmware wac6303d-s_firmware wac6553d-s_firmware usg_flex_200 nwa210ax usg_40_firmware atp100w usg_flex_200_firmware nxc5500 usg210_firmware usg_20w_firmware nwa1123acv3 usg300 vpn100_firmware usg_flex_700 usg_60_firmware nwa1123-ac-hd_firmware usg2200_firmware nwa55axe nap353_firmware wax630s_firmware wac6503d-s_firmware wac500_firmware usg_60 usg20_firmware wac6303d-s nwa5123-ac-hd usg_flex_100_firmware nxc5500_firmware wac6503d-s nwa90ax wax510d nxc2500_firmware wac6502d-s usg_flex_700_firmware vpn1000 usg_1100_firmware ATP series firmware WAC500 firmware NSG series firmware VPN series firmware NXC2500 firmware NWA50AX firmware USG FLEX series firmware USG/ZyWALL series firmware WAX510D firmware NAP203 firmware

CWE ID-CWE-20

Improper Input Validation

CVE-2023-22916

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Affected

Affected

Affected

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs