CVE-2023-33012

State: Published
Severity: 8.8 High
Published: Jul 17, 2023
Updated: Mar 5, 2025
Reserved: May 17, 2023

Description

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Zyxel

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
ATP series firmwareZyxel	5.10 through 5.36 Patch 2Affected
USG FLEX series firmwareZyxel	5.00 through 5.36 Patch 2Affected
USG FLEX 50(W) series firmwareZyxel	5.10 through 5.36 Patch 2Affected
USG20(W)-VPN series firmwareZyxel	5.10 through 5.36 Patch 2Affected
VPN series firmwareZyxel	5.00 through 5.36 Patch 2Affected

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.