CVE-2023-22918
Last modified
CVE-2023-22918 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.. EPSS estimates a 0.77% chance of exploitation in the next 30 days.
Description
A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Atp200 Firmware | >= 4.32, < 5.36 |
| Zyxel | Atp100 Firmware | >= 4.32, < 5.36 |
| Zyxel | Atp700 Firmware | >= 4.32, < 5.36 |
| Zyxel | Atp500 Firmware | >= 4.32, < 5.36 |
| Zyxel | Atp100w Firmware | >= 4.32, < 5.36 |
| Zyxel | Atp800 Firmware | >= 4.32, < 5.36 |
| Zyxel | Usg Flex 100 Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg Flex 50 Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg Flex 200 Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg Flex 500 Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg Flex 700 Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg Flex 100w Firmware | >= 4.50, < 5.36 |
| Zyxel | Usg 20w-Vpn Firmware | >= 4.16, < 5.36 |
| Zyxel | Usg Flex 50w Firmware | >= 4.16, < 5.36 |
| Zyxel | Usg20-Vpn Firmware | >= 4.30, < 5.36 |
| Zyxel | Vpn100 Firmware | >= 4.30, < 5.36 |
| Zyxel | Vpn1000 Firmware | >= 4.30, < 5.36 |
| Zyxel | Vpn300 Firmware | >= 4.30, < 5.36 |
| Zyxel | Vpn50 Firmware | >= 4.30, < 5.36 |
| Zyxel | Nap203 Firmware | <= 6.28\(abfa.0\) |
| Zyxel | Nap303 Firmware | <= 6.28\(abex.0\) |
| Zyxel | Nap353 Firmware | <= 6.28\(abey.0\) |
| Zyxel | Nwa110ax Firmware | <= 6.50\(abtg.2\) |
| Zyxel | Nwa1123-Ac Hd Firmware | <= 6.25\(abin.9\) |
| Zyxel | Nwa1123-Ac-Pro Firmware | <= 6.28\(abhd.0\) |
| Zyxel | Nwa1123acv3 Firmware | <= 6.50\(abvt.0\) |
| Zyxel | Nwa210ax Firmware | <= 6.50\(abtd.2\) |
| Zyxel | Nwa220ax-6e Firmware | <= 6.50\(acco.2\) |
| Zyxel | Nwa50ax Firmware | <= 6.55\(acge.1\) |
| Zyxel | Nwa50ax-Pro Firmware | <= 6.50\(acge.0\) |
| Zyxel | Nwa5123-Ac Hd Firmware | <= 6.25\(abim.9\) |
| Zyxel | Nwa55axe Firmware | <= 6.29\(abzl.1\) |
| Zyxel | Nwa90ax Firmware | <= 6.29\(accv.1\) |
| Zyxel | Nwa90ax-Pro Firmware | <= 6.50\(acgf.0\) |
| Zyxel | Wac500 Firmware | <= 6.50\(abvs.0\) |
| Zyxel | Wac500h Firmware | <= 6.50\(abwa.0\) |
| Zyxel | Wac5302d-Sv2 Firmware | <= 6.25\(abvz.9\) |
| Zyxel | Wac6103d-I Firmware | <= 6.28\(aaxh.0\) |
| Zyxel | Wac6303d-S Firmware | <= 6.25\(abgl.9\) |
| Zyxel | Wac6502d-E Firmware | <= 6.28\(aasd.0\) |
| Zyxel | Wac6502d-S Firmware | <= 6.28\(aase.0\) |
| Zyxel | Wac6503d-S Firmware | <= 6.28\(aasf.0\) |
| Zyxel | Wac6552d-S Firmware | <= 6.28\(abio.0\) |
| Zyxel | Wac6553d-E Firmware | <= 6.28\(aasg.0\) |
| Zyxel | Wax510d Firmware | <= 6.50\(abtf.2\) |
| Zyxel | Wax610d Firmware | <= 6.50\(abte.2\) |
| Zyxel | Wax620d-6e Firmware | <= 6.50\(accn.2\) |
| Zyxel | Wax630s Firmware | <= 6.50\(abzd.2\) |
| Zyxel | Wax640s-6e Firmware | <= 6.50\(accm.2\) |
| Zyxel | Wax650s Firmware | <= 6.50\(abrm.2\) |
Showing 50 of 51 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-22918?
How severe is CVE-2023-22918?
How do I fix CVE-2023-22918?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22912An issue was discovered in MediaWiki before 1.35.9, 1.36.x t…5.3
- CVE-2023-22913A post-authentication command injection vulnerability in the…8.1
- CVE-2023-22914A path traversal vulnerability in the “account_print.cgi” CG…7.2
- CVE-2023-22915A buffer overflow vulnerability in the “fbwifi_forward.cgi” …7.5
- CVE-2023-22916The configuration parser of Zyxel ATP series firmware versio…8.1
- CVE-2023-22917A buffer overflow vulnerability in the “sdwan_iface_ipc” bin…7.5
- CVE-2023-22919The post-authentication command injection vulnerability in t…8.8
- CVE-2023-22920A security misconfiguration vulnerability exists in the Zyxe…9.8
- CVE-2023-22921A cross-site scripting (XSS) vulnerability in the Zyxel NBG-…7.5
- CVE-2023-22922A buffer overflow vulnerability in the Zyxel NBG-418N v2 fir…7.5
- CVE-2023-22923A format string vulnerability in a binary of the Zyxel NBG-4…6.5
- CVE-2023-22924A buffer overflow vulnerability in the Zyxel NBG-418N v2 fir…4.9
Are you affected by CVE-2023-22918?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST