A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP.
History

Thu, 05 Sep 2024 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld Firmware
CPEs cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zld_firmware:*:*:*:*:*:*:*:*
Vendors & Products Zyxel atp100
Zyxel atp100w
Zyxel atp200
Zyxel atp500
Zyxel atp700
Zyxel atp800
Zyxel usg 20w-vpn
Zyxel usg Flex 100
Zyxel usg Flex 100ax
Zyxel usg Flex 100w
Zyxel usg Flex 200
Zyxel usg Flex 50
Zyxel usg Flex 500
Zyxel usg Flex 50w
Zyxel usg Flex 700
Zyxel zld Firmware

Tue, 03 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Zyxel
Zyxel atp100 Firmware
Zyxel atp100w Firmware
Zyxel atp200 Firmware
Zyxel atp500 Firmware
Zyxel atp700 Firmware
Zyxel atp800 Firmware
Zyxel usg20w-vpn Firmware
Zyxel usg Flex 100 Firmware
Zyxel usg Flex 100ax Firmware
Zyxel usg Flex 100h Firmware
Zyxel usg Flex 100w Firmware
Zyxel usg Flex 200 Firmware
Zyxel usg Flex 200h Firmware
Zyxel usg Flex 500 Firmware
Zyxel usg Flex 500h Firmware
Zyxel usg Flex 50 Firmware
Zyxel usg Flex 50ax Firmware
Zyxel usg Flex 50w Firmware
Zyxel usg Flex 700 Firmware
Zyxel usg Flex 700h Firmware
CPEs cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*
Vendors & Products Zyxel
Zyxel atp100 Firmware
Zyxel atp100w Firmware
Zyxel atp200 Firmware
Zyxel atp500 Firmware
Zyxel atp700 Firmware
Zyxel atp800 Firmware
Zyxel usg20w-vpn Firmware
Zyxel usg Flex 100 Firmware
Zyxel usg Flex 100ax Firmware
Zyxel usg Flex 100h Firmware
Zyxel usg Flex 100w Firmware
Zyxel usg Flex 200 Firmware
Zyxel usg Flex 200h Firmware
Zyxel usg Flex 500 Firmware
Zyxel usg Flex 500h Firmware
Zyxel usg Flex 50 Firmware
Zyxel usg Flex 50ax Firmware
Zyxel usg Flex 50w Firmware
Zyxel usg Flex 700 Firmware
Zyxel usg Flex 700h Firmware
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 03 Sep 2024 02:00:00 +0000

Type Values Removed Values Added
Description A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Zyxel

Published: 2024-09-03T01:51:20.796Z

Updated: 2024-09-03T13:53:11.888Z

Reserved: 2024-07-29T02:36:19.275Z

Link: CVE-2024-42059

cve-icon Vulnrichment

Updated: 2024-09-03T13:51:42.974Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-03T02:15:04.690

Modified: 2024-09-05T14:38:26.533

Link: CVE-2024-42059

cve-icon Redhat

No data.