CVE-2023-33012
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
CVE-2023-33012 describes a command injection vulnerability in the configuration parser of Zyxel ATP and USG FLEX firmware. An unauthenticated, LAN-based attacker could execute OS commands using a crafted GRE configuration when cloud management mode is enabled.
Risk Assessment
This vulnerability poses a significant security risk, allowing attackers to remotely execute commands on devices, potentially leading to system takeover.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to disable cloud management mode if it is not necessary.
Original NVD description (English source)
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.