{"schemaVersion":3,"id":"CVE-2023-34141","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.00 through 5.36 Patch 2, VPN series firmware versions 5.00 through 5.36 Patch 2, NXC2500 firmware versions 6.10(AAIG.0) through 6.10(AAIG.3), and NXC5500 firmware versions 6.10(AAOS.0) through 6.10(AAOS.4), could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if the attacker could trick an authorized administrator to add their IP address to the managed AP list in advance.","dates":{"published":"2023-07-17T17:56:26.818Z","modified":"2024-10-29T16:06:41.479Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00684,"percentile":0.51754,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00684},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00684,"percentile":0.51754}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00684,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00684,"percentile":0.51754}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html"}],"affected":[{"vendor":"zyxel","product":"atp series firmware","name":"ATP series firmware","label":"atp series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.00 through 5.36 Patch 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.00 through 5.36 Patch 2","eol":null,"hubHref":"/vendor/zyxel/atp_series_firmware"},{"vendor":"zyxel","product":"nxc2500_firmware","name":"nxc2500 firmware","label":"nxc2500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 6.10\\(aaig.0\\), ≤ 6.10\\(aaig.3\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.10\\(aaig.0\\), ≤ 6.10\\(aaig.3\\)","eol":null,"hubHref":"/vendor/zyxel/nxc2500"},{"vendor":"zyxel","product":"nxc2500 firmware","name":"NXC2500 firmware","label":"nxc2500 firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.10(AAIG.0) through 6.10(AAIG.3)","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.10(AAIG.0) through 6.10(AAIG.3)","eol":null,"hubHref":"/vendor/zyxel/nxc2500_firmware"},{"vendor":"zyxel","product":"nxc5500_firmware","name":"nxc5500 firmware","label":"nxc5500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 6.10\\(aaos.0\\), ≤ 6.10\\(aaos.4\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.10\\(aaos.0\\), ≤ 6.10\\(aaos.4\\)","eol":null,"hubHref":"/vendor/zyxel/nxc5500"},{"vendor":"zyxel","product":"nxc5500 firmware","name":"NXC5500 firmware","label":"nxc5500 firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.10(AAOS.0) through 6.10(AAOS.4)","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.10(AAOS.0) through 6.10(AAOS.4)","eol":null,"hubHref":"/vendor/zyxel/nxc5500_firmware"},{"vendor":"zyxel","product":"usg_20w-vpn_firmware","name":"usg 20w-vpn firmware","label":"usg_20w-vpn_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_20w-vpn"},{"vendor":"zyxel","product":"usg_2200-vpn_firmware","name":"usg 2200-vpn firmware","label":"usg_2200-vpn_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_2200-vpn"},{"vendor":"zyxel","product":"usg_flex_100_firmware","name":"usg flex 100 firmware","label":"usg_flex_100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100"},{"vendor":"zyxel","product":"usg_flex_100w_firmware","name":"usg flex 100w firmware","label":"usg_flex_100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100w"},{"vendor":"zyxel","product":"usg_flex_200_firmware","name":"usg flex 200 firmware","label":"usg_flex_200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_200"},{"vendor":"zyxel","product":"usg_flex_50_firmware","name":"usg flex 50 firmware","label":"usg_flex_50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_50"},{"vendor":"zyxel","product":"usg_flex_500_firmware","name":"usg flex 500 firmware","label":"usg_flex_500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_500"},{"vendor":"zyxel","product":"usg_flex_50w_firmware","name":"usg flex 50w firmware","label":"usg_flex_50w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_50w"},{"vendor":"zyxel","product":"usg flex 50(w) series firmware","name":"USG FLEX 50(W) series firmware","label":"usg flex 50(w) series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.00 through 5.36 Patch 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.00 through 5.36 Patch 2","eol":null,"hubHref":"/vendor/zyxel/usg_flex_50w_series_firmware"},{"vendor":"zyxel","product":"usg_flex_700_firmware","name":"usg flex 700 firmware","label":"usg_flex_700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/usg_flex_700"},{"vendor":"zyxel","product":"usg flex series firmware","name":"USG FLEX series firmware","label":"usg flex series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.00 through 5.36 Patch 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.00 through 5.36 Patch 2","eol":null,"hubHref":"/vendor/zyxel/usg_flex_series_firmware"},{"vendor":"zyxel","product":"usg20(w)-vpn series firmware","name":"USG20(W)-VPN series firmware","label":"usg20(w)-vpn series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.00 through 5.36 Patch 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.00 through 5.36 Patch 2","eol":null,"hubHref":"/vendor/zyxel/usg20w-vpn_series_firmware"},{"vendor":"zyxel","product":"vpn series firmware","name":"VPN series firmware","label":"vpn series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.00 through 5.36 Patch 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.00 through 5.36 Patch 2","eol":null,"hubHref":"/vendor/zyxel/vpn_series_firmware"},{"vendor":"zyxel","product":"zywall_atp100_firmware","name":"zywall atp100 firmware","label":"zywall_atp100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp100"},{"vendor":"zyxel","product":"zywall_atp100w_firmware","name":"zywall atp100w firmware","label":"zywall_atp100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp100w"},{"vendor":"zyxel","product":"zywall_atp200_firmware","name":"zywall atp200 firmware","label":"zywall_atp200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp200"},{"vendor":"zyxel","product":"zywall_atp500_firmware","name":"zywall atp500 firmware","label":"zywall_atp500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp500"},{"vendor":"zyxel","product":"zywall_atp700_firmware","name":"zywall atp700 firmware","label":"zywall_atp700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp700"},{"vendor":"zyxel","product":"zywall_atp800_firmware","name":"zywall atp800 firmware","label":"zywall_atp800_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_atp800"},{"vendor":"zyxel","product":"zywall_vpn_100_firmware","name":"zywall vpn 100 firmware","label":"zywall_vpn_100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn_100"},{"vendor":"zyxel","product":"zywall_vpn_300_firmware","name":"zywall vpn 300 firmware","label":"zywall_vpn_300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn_300"},{"vendor":"zyxel","product":"zywall_vpn_50_firmware","name":"zywall vpn 50 firmware","label":"zywall_vpn_50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn_50"},{"vendor":"zyxel","product":"zywall_vpn100_firmware","name":"zywall vpn100 firmware","label":"zywall_vpn100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn100"},{"vendor":"zyxel","product":"zywall_vpn2s_firmware","name":"zywall vpn2s firmware","label":"zywall_vpn2s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn2s"},{"vendor":"zyxel","product":"zywall_vpn300_firmware","name":"zywall vpn300 firmware","label":"zywall_vpn300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn300"},{"vendor":"zyxel","product":"zywall_vpn50_firmware","name":"zywall vpn50 firmware","label":"zywall_vpn50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.00, < 5.37","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.00, < 5.37","eol":null,"hubHref":"/vendor/zyxel/zywall_vpn50"}],"affectedCount":31,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers","label":"www.zyxel.com/global/…","hostname":"www.zyxel.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-07-17T17:56:26.818Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-10-29T16:06:41.479Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T09:07:28.426Z","stale":false,"partial":false}}