CVE-2023-28767

Summary

CVE-2023-28767 is a vulnerability affecting multiple Zyxel firmware versions, including those for the ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series. The issue lies in the configuration parser, which fails to sanitize user-controlled input. An unauthenticated attacker, located in the LAN, can exploit this vulnerability when cloud management mode is enabled, allowing them to inject OS commands into the device configuration data. This could potentially lead to significant security compromises. The Zyxel ATP series firmware versions 5.10 to 5.36, as well as the USG FLEX series firmware versions 5.00 to 5.36, USG FLEX 50(W) series firmware versions 5.10 to 5.36, USG20(W)-VPN series firmware versions 5.10 to 5.36, and VPN series firmware versions 5.00 to 5.36, are all vulnerable to this issue. An attacker can take advantage of this vulnerability by injecting OS commands into the device configuration data of an affected device. This can result in potential security breaches and unauthorized access to the device, particularly when the cloud management mode is enabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.