CVE-2023-22918

State: Published
Severity: 6.5 Medium
Published: Apr 24, 2023
Updated: Feb 12, 2025
Reserved: Jan 10, 2023

Description

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	Zyxel

Weaknesses

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

Affected Products

Product	Versions
ATP series firmwareZyxel	4.32 through 5.35Affected
USG FLEX series firmwareZyxel	4.50 through 5.35Affected
USG FLEX 50(W) firmwareZyxel	4.16 through 5.35Affected
USG20(W)-VPN firmwareZyxel	4.16 through 5.35Affected
VPN series firmwareZyxel	4.30 through 5.35Affected
NWA110AX firmwareZyxel	<= 6.50(ABTG.2)Affected
WAC500 firmwareZyxel	<= 6.50(ABVS.0)Affected
WAX510D firmwareZyxel	<= 6.50(ABTF.2)Affected

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.