CVE-2023-37925

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37925
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps Vendor Advisory
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50w:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax-pro:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax-pro:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:12

Type Values Removed Values Added
References () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps - Vendor Advisory () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps - Vendor Advisory

04 Dec 2023, 18:09

Type Values Removed Values Added
References () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps - () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps - Vendor Advisory
CPE cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax-pro:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa50ax-pro:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:*
First Time Zyxel nwa90ax
Zyxel wax640s-6e
Zyxel nwa210ax
Zyxel atp800
Zyxel wax630s
Zyxel usg Flex 200
Zyxel wax655e Firmware
Zyxel wac500h
Zyxel wax610d
Zyxel usg Flex 700
Zyxel nwa1123acv3
Zyxel wax620d-6e
Zyxel usg Flex 50
Zyxel atp100w
Zyxel atp500
Zyxel usg Flex 100
Zyxel nwa55axe
Zyxel wax650s
Zyxel usg 20w-vpn
Zyxel nwa90ax-pro Firmware
Zyxel wac500h Firmware
Zyxel atp700
Zyxel vpn1000
Zyxel wac500
Zyxel nwa50ax-pro
Zyxel wax630s Firmware
Zyxel usg Flex 50w
Zyxel nwa220ax-6e
Zyxel nwa110ax Firmware
Zyxel
Zyxel atp200
Zyxel vpn50w
Zyxel nwa90ax-pro
Zyxel atp100
Zyxel wax655e
Zyxel wbe660s
Zyxel nwa220ax-6e Firmware
Zyxel vpn300
Zyxel wbe660s Firmware
Zyxel nwa50ax Firmware
Zyxel wax620d-6e Firmware
Zyxel wax510d Firmware
Zyxel nwa50ax-pro Firmware
Zyxel zld
Zyxel usg Flex 500
Zyxel vpn50
Zyxel wax510d
Zyxel vpn100
Zyxel nwa90ax Firmware
Zyxel nwa110ax
Zyxel usg Flex 100w
Zyxel nwa210ax Firmware
Zyxel wax610d Firmware
Zyxel wax650s Firmware
Zyxel nwa1123acv3 Firmware
Zyxel wax640s-6e Firmware
Zyxel nwa55axe Firmware
Zyxel wac500 Firmware
Zyxel nwa50ax

28 Nov 2023, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-28 02:15

Updated : 2024-11-21 08:12

NVD link : CVE-2023-37925

Mitre link : CVE-2023-37925

CVE.ORG link : CVE-2023-37925

JSON object : View

Products Affected

zyxel

  • wac500
  • zld
  • atp200
  • wac500h
  • wax650s
  • usg_flex_50w
  • atp500
  • usg_flex_700
  • nwa210ax_firmware
  • wax610d_firmware
  • wax640s-6e_firmware
  • nwa110ax
  • atp700
  • vpn50
  • usg_flex_100w
  • usg_flex_200
  • nwa1123acv3_firmware
  • vpn100
  • atp100
  • nwa210ax
  • atp800
  • nwa110ax_firmware
  • wax630s
  • nwa90ax_firmware
  • nwa90ax-pro_firmware
  • atp100w
  • vpn1000
  • nwa1123acv3
  • nwa220ax-6e_firmware
  • nwa220ax-6e
  • nwa90ax
  • wax510d_firmware
  • wax655e_firmware
  • nwa50ax-pro_firmware
  • usg_flex_50
  • wax510d
  • wax620d-6e
  • wax650s_firmware
  • nwa55axe_firmware
  • wax610d
  • wbe660s_firmware
  • vpn50w
  • usg_flex_100
  • wax620d-6e_firmware
  • wax640s-6e
  • wbe660s
  • nwa50ax-pro
  • nwa90ax-pro
  • wac500_firmware
  • wax630s_firmware
  • nwa55axe
  • vpn300
  • nwa50ax
  • wax655e
  • nwa50ax_firmware
  • wac500h_firmware
  • usg_20w-vpn
  • usg_flex_500
CWE
CWE-269

Improper Privilege Management