CVE-2023-34141

Vulnerability

A command injection vulnerability exists in the access point (AP) management feature of Zyxel ATP (5.00 through 5.36 Patch 2), USG FLEX (5.00 through 5.36 Patch 2), USG FLEX 50(W) (5.00 through 5.36 Patch 2), USG20(W)-VPN (5.00 through 5.36 Patch 2), VPN (5.00 through 5.36 Patch 2), NXC2500 (6.10(AAIG.0) through 6.10(AAIG.3)), and NXC5500 (6.10(AAOS.0) through 6.10(AAOS.4)) firmware versions. The flaw specifically resides in the handling of managed AP IP addresses, where user-supplied input is not properly sanitized before being used in OS commands [1].

Exploitation

An attacker must be on the same LAN segment as the affected device. The attack requires a prior action from an authorized administrator: the admin must have added the attacker's IP address to the list of managed APs. Once that IP is on the list, an unauthenticated, LAN-based attacker can exploit the command injection to execute arbitrary OS commands on the device [1].

Impact

Successful exploitation allows an unauthenticated, LAN-based attacker to execute operating system commands on the vulnerable device. This can lead to full compromise of the device's confidentiality, integrity, and availability, as the attacker can read, modify, or delete data, install malware, or disrupt operations [1].

Mitigation

Zyxel has released patches for all affected firmware versions. Users should update to the latest firmware versions as indicated in the security advisory [1]. No workaround is provided; installing the patched firmware is the only recommended mitigation.