Medium severity4.8NVD Advisory· Published Apr 24, 2023· Updated Jun 17, 2026

CVE-2023-27990

Description

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zyxel/Atp100 Firmware
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Atp100w Firmware
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Atp200 Firmware
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Atp500 Firmware
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Atp700 Firmware
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Atp800 Firmware
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
Range: >=4.32,<5.36
Zyxel/Usg20 VPN Firmware2 versions
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*range: >=4.30,<5.36
- (no CPE)range: 4.16 through 5.35
Zyxel/Usg20w VPN Firmware
cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*
Range: >=4.16,<5.36
Zyxel/Usg Flex 100 Firmware
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Usg Flex 100w Firmware
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Usg Flex 200 Firmware
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Usg Flex 500 Firmware
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Usg Flex 50 Firmware
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Usg Flex 50w Firmware2 versions
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*range: >=4.16,<5.36
- (no CPE)range: 4.16 - 5.35
Zyxel/Usg Flex 700 Firmware
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
Range: >=4.50,<5.36
Zyxel/Vpn1000 Firmware
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*
Range: >=4.30,<5.36
Zyxel/Vpn100 Firmware
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*
Range: >=4.30,<5.36
Zyxel/Vpn300 Firmware
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*
Range: >=4.30,<5.36
Zyxel/Vpn50 Firmware
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*
Range: >=4.30,<5.36
Zyxel/ATP series firmwarellm-fuzzy
Range: 4.32 - 5.35
Zyxel/USG FLEX series firmwarellm-fuzzy
Range: 4.50 - 5.35
Zyxel/USG20(W)-VPN series firmwarellm-fuzzy
Range: 4.16 - 5.35
Zyxel/VPN series firmwarellm-fuzzy
Range: 4.30 - 5.35
Zyxel/ATP seriescpe-rescue
Range: 4.32 through 5.35
Zyxel/USG FLEX 50(W)cpe-rescue
Range: 4.16 through 5.35
Zyxel/USG FLEX seriescpe-rescue
Range: 4.50 through 5.35
Zyxel/VPN seriescpe-rescue
Range: 4.30 through 5.35

Patches

Vulnerability mechanics

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewallsnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000