Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-35139

A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50(W) series firmware versions 5.10 through 5.37, USG20(W)-VPN series firmware versions 5.10 through 5.37, and VPN series firmware versions 5.00 through 5.37, could allow an unauthenticated LAN-based attacker to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed to steal cookies when the user visits the specific CGI used for dumping ZTP logs.

Published

2023-11-28T02:15:42.347

Last Modified

2024-11-21T08:08:00.870

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.2 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System zyxel zld ≤ 5.37 Yes
Hardware zyxel atp100 - No
Hardware zyxel atp100w - No
Hardware zyxel atp200 - No
Hardware zyxel atp500 - No
Hardware zyxel atp700 - No
Hardware zyxel atp800 - No
Operating System zyxel zld ≤ 5.37 Yes
Hardware zyxel usg_flex_100 - No
Hardware zyxel usg_flex_100w - No
Hardware zyxel usg_flex_200 - No
Hardware zyxel usg_flex_50 - No
Hardware zyxel usg_flex_500 - No
Hardware zyxel usg_flex_50w - No
Hardware zyxel usg_flex_700 - No
Operating System zyxel zld ≤ 5.37 Yes
Hardware zyxel usg_20w-vpn - No
Hardware zyxel vpn50w - No
Operating System zyxel zld ≤ 5.37 Yes
Hardware zyxel vpn100 - No
Hardware zyxel vpn1000 - No
Hardware zyxel vpn300 - No
Hardware zyxel vpn50 - No
References