CVE-2023-5797

Vulnerability

An improper privilege management vulnerability exists in the debug CLI command of Zyxel firmware versions. Affected models include ATP series (firmware 4.32 through 5.37), USG FLEX series (4.50 through 5.37), USG FLEX 50(W) series (4.16 through 5.37), USG20(W)-VPN series (4.16 through 5.37), VPN series (4.30 through 5.37), NWA50AX (6.29(ABYW.2)), WAC500 (6.65(ABVS.1)), WAX300H (6.60(ACHF.1)), and WBE660S (6.65(ACGG.1)). The issue allows an authenticated local attacker to access administrator logs [1].

Exploitation

To exploit this vulnerability, an attacker requires authenticated local access to the device, for example via SSH or console. By invoking the debug CLI command with crafted parameters, the attacker can bypass privilege checks and read logs normally restricted to the administrator [1].

Impact

Successful exploitation enables the attacker to access sensitive administrator logs, potentially revealing configuration details, network topology, or other confidential information. This constitutes a breach of confidentiality, with no impact on integrity or availability [1].

Mitigation

Zyxel has released firmware patches for affected products. Firewall users should upgrade to version 5.38 or later. AP users should check the advisory for specific patched versions. If patching is not immediately possible, restrict local access to trusted users. No CVE-2023-5797 is listed on CISA's KEV [1].