High severity7.2NVD Advisory· Published Feb 20, 2024· Updated Jun 17, 2026

CVE-2023-6398

Description

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1,

USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,

NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

101

Zyxel/Atp100 Firmware3 versions
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Atp100w Firmware3 versions
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Atp200 Firmware3 versions
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Atp500 Firmware3 versions
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Atp700 Firmware3 versions
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Atp800 Firmware3 versions
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*range: >=4.32,<5.37
- cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Nwa110ax Firmware
cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abtg.2\)
Zyxel/Nwa1123acv3 Firmware
cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abvt.1\)
Zyxel/Nwa210ax Firmware
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abtd.2\)
Zyxel/Nwa220ax 6e Firmware
cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(acco.1\)
Zyxel/Nwa50ax Pro Firmware
cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:*
Range: <6.80\(acge.0\)
Zyxel/Nwa50ax Firmware2 versions
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*range: <6.29\(abyw.4\)
- (no CPE)range: < 6.29(ABYW.4)
Zyxel/Nwa55axe Firmware
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*
Range: <6.29\(abzl.4\)
Zyxel/Nwa90ax Pro Firmware
cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:*
Range: <6.80\(acgf.0\)
Zyxel/Nwa90ax Firmware
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*
Range: <6.29\(accv.4\)
Zyxel/Uos2 versions
cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:*
Zyxel/Usg20 VPN Firmware3 versions
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*range: >=4.16,<5.37
- cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg20w VPN Firmware3 versions
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*range: >=4.16,<5.37
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 100 Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 100ax Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 100h Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 100w Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 200 Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 200h Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 200hp Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 500 Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 500h Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 50 Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*range: >=4.16,<5.37
- cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 50w Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*range: >=4.16,<5.37
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 700 Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Usg Flex 700h Firmware3 versions
cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*range: >=4.50,<5.37
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:*
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:*
Zyxel/Wac500 Firmware2 versions
cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*range: <6.70\(abvs.1\)
- (no CPE)range: < 6.70(ABVS.1)
Zyxel/Wac500h Firmware
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abwa.1\)
Zyxel/Wax300h Firmware2 versions
cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*range: <6.70\(achf.1\)
- (no CPE)range: < 6.70(ACHF.1)
Zyxel/Wax510d Firmware
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abtf.2\)
Zyxel/Wax610d Firmware
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abte.2\)
Zyxel/Wax620d 6e Firmware
cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(accn.1\)
Zyxel/Wax630s Firmware
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abzd.2\)
Zyxel/Wax640s 6e Firmware
cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(accm.1\)
Zyxel/Wax650s Firmware
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(abrm.2\)
Zyxel/Wax655e Firmware
cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*
Range: <6.70\(acdo.1\)
Zyxel/Wbe660s Firmware2 versions
cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*range: <6.70\(acgg.2\)
- (no CPE)range: < 6.70(ACGG.1)
Zyxel/NWA50AXllm-fuzzy
Range: through 6.29(ABYW.3)
Zyxel/ATP series firmwarellm-fuzzy
Range: 4.32 - 5.37 Patch 1
Zyxel/USG FLEX series firmwarellm-fuzzy
Range: 4.50 - 5.37 Patch 1
Zyxel/USG20(W)-VPN series firmwarellm-fuzzy
Range: 4.16 - 5.37 Patch 1
Zyxel/WAX300Hllm-fuzzy
Range: through 6.60(ACHF.1)
Zyxel/WBE660Sllm-fuzzy
Range: through 6.65(ACGG.1)
Zyxel/WAC500llm-fuzzy
Range: through 6.65(ABVS.1)
Zyxel/ATP seriescpe-rescue
Range: version 4.32 through 5.37 Patch 1
Zyxel/USG FLEX seriescpe-rescue3 versions
version 4.16 through 5.37 Patch 1+ 2 more
- (no CPE)range: version 4.16 through 5.37 Patch 1
- (no CPE)range: version 1.10 through 1.10 Patch 1
- (no CPE)range: version 4.50 through 5.37 Patch 1
Zyxel/USG20(W)-VPN seriescpe-rescue
Range: version 4.16 through 5.37 Patch 1

Patches

Vulnerability mechanics

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000