CVE-2023-22916

Vulnerability

The configuration parser in Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35 fails to properly sanitize user input [1]. This vulnerability allows a remote unauthenticated attacker to modify device configuration data, leading to denial-of-service (DoS) conditions on an affected device [1].

Exploitation

An attacker must trick an authorized administrator into switching the management mode to cloud mode [1]. The attacker does not need authentication but relies on social engineering or other means to deceive the administrator [1]. WAN access to the management interface is disabled by default, so the attacker typically needs to be on the same LAN as the device or have already compromised another host on the network [1].

Impact

Successful exploitation results in the attacker modifying device configuration data, causing DoS conditions [1]. The device becomes unavailable for legitimate use, disrupting network services provided by the firewall [1]. There is no indication of data confidentiality or integrity impact beyond the DoS state.

Mitigation

Zyxel released fixed firmware versions: ATP series 5.36, USG FLEX series 5.36, USG FLEX 50(W) 5.36, USG20(W)-VPN 5.36, and VPN series 5.36 [1]. Users should update to these or later versions [1]. No workarounds are provided in the advisory; enabling WAN access control and restricting management access to trusted networks can reduce exposure [1].