CVE-2023-34138

Vulnerability

A command injection vulnerability exists in the hotspot management feature of Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series firmware versions 4.60 through 5.36 Patch 2. The vulnerability allows an unauthenticated, LAN-based attacker to execute arbitrary OS commands on the device if an authorized administrator has previously added the attacker's IP address to the list of trusted RADIUS clients [1].

Exploitation

To exploit this vulnerability, an attacker must have LAN access and trick an authorized administrator into adding their IP address to the trusted RADIUS client list. Once added, the attacker can send specially crafted input to the hotspot management feature, leading to command injection and execution of arbitrary OS commands [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the affected device. This can lead to full compromise of the device, including unauthorized access, data disclosure, and further network attacks [1].

Mitigation

Zyxel has released patches to fix this vulnerability. Users are advised to update their firmware to the latest version. The fixed versions are available in the vendor advisory [1].