CVE-2023-35136

Vulnerability

An improper input validation vulnerability exists in the "Quagga" package of Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37. The bug occurs when the affected device processes certain inputs without proper validation, enabling an authenticated local attacker to access configuration files. [1]

Exploitation

An attacker must have local, authenticated access to the affected device. No special privileges beyond initial authentication are required; the attacker can then exploit the improper input validation to read configuration files that should be restricted. [1]

Impact

Successful exploitation allows the attacker to read configuration files on the device, leading to information disclosure of sensitive settings and potentially further compromise. The attacker does not gain code execution or privilege escalation directly from this vulnerability. [1]

Mitigation

Zyxel released patches addressing this vulnerability in firmware versions after 5.37 for the affected series. Users are advised to update to the latest firmware available from Zyxel's support site. No workaround is provided; installing the patch is the recommended mitigation. [1]