CVE-2023-37926
Assigner: Zyxel
Published: 2023-11-28T01:37:19.483Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: ATP series firmware
vendor: Zyxel
versions: status: affected
version: versions 4.32 through 5.37
defaultStatus: unaffected
product: USG FLEX series firmware
vendor: Zyxel
versions: status: affected
version: versions 4.50 through 5.37
defaultStatus: unaffected
product: USG FLEX 50(W) series firmware
vendor: Zyxel
versions: status: affected
version: versions 4.16 through 5.37
defaultStatus: unaffected
product: USG20(W)-VPN series firmware
vendor: Zyxel
versions: status: affected
version: versions 4.16 through 5.37
defaultStatus: unaffected
product: VPN series firmware
vendor: Zyxel
versions: status: affected
version: versions 4.30 through 5.37
descriptions: supportingMedia: base64: no
type: text/html
value: A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to cause denial-of-service (DoS) conditions by executing the CLI command to dump system logs on an affected device.
value: A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to cause denial-of-service (DoS) conditions by executing the CLI command to dump system logs on an affected device.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev