CVE-2023-28767

Vulnerability

The configuration parser in Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5.10 through 5.36, USG20(W)-VPN series firmware versions 5.10 through 5.36, and VPN series firmware versions 5.00 through 5.36 fails to sanitize user-controlled input. This allows an unauthenticated, LAN-based attacker to inject operating system (OS) commands into the device configuration data when the cloud management mode is enabled [1].

Exploitation

An attacker with LAN access and no authentication can craft malicious configuration data. The attack requires the cloud management mode to be enabled on the affected device. The attacker does not need any prior access or user interaction [1].

Impact

Successful exploitation enables the attacker to execute arbitrary OS commands on the device. This can lead to full compromise of the firewall, including data exfiltration, further network attacks, and persistent control [1].

Mitigation

Zyxel has released firmware patches to address this vulnerability. Users should update to the latest firmware versions as specified in the security advisory [1]. No workaround is documented; disabling cloud management mode may reduce exposure if patching is delayed.