CVE-2023-34139: Command Injection
Published Jul 17, 2023
·Updated
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.
Affected Software
60 affected components
Zyxel Usg 2200-vpn Firmware>=4.20<5.37
Zyxel Usg 2200-vpn
Zyxel Usg Flex 100 Firmware>=4.50<5.37
Zyxel Usg Flex 100
Zyxel Usg Flex 100w Firmware>=4.50<5.37
Zyxel Usg Flex 100w
Zyxel USG FLEX 200 firmware>=4.50<5.37
Zyxel USG FLEX 200
Zyxel Usg Flex 50 Firmware>=4.50<5.37
Zyxel USG FLEX 50
Zyxel USG FLEX 500 firmware>=4.50<5.37
Zyxel USG FLEX 500
Zyxel Usg Flex 50w Firmware>=4.50<5.37
Zyxel Usg Flex 50w
Zyxel USG FLEX 700 firmware>=4.50<5.37
Zyxel USG FLEX 700
Zyxel Zywall Vpn100 Firmware>=4.20<5.37
Zyxel Zywall Vpn100
Zyxel Zywall Vpn2s Firmware>=4.20<5.37
Zyxel Zywall Vpn2s
Zyxel Zywall Vpn300 Firmware>=4.20<5.37
Zyxel Zywall Vpn300
Zyxel Zywall Vpn50 Firmware>=4.20<5.37
Zyxel Zywall Vpn50
Zyxel Zywall Vpn 100 Firmware>=4.20<5.37
Zyxel Zywall Vpn 100
Zyxel Zywall Vpn 300 Firmware>=4.20<5.37
Zyxel Zywall Vpn 300
Zyxel Zywall Vpn 50 Firmware>=4.20<5.37
Zyxel Zywall Vpn 50
All of the following
Zyxel Usg 2200-vpn Firmware>=4.20<5.37
Zyxel Usg 2200-vpn
All of the following
Zyxel Usg Flex 100 Firmware>=4.50<5.37
Zyxel Usg Flex 100
All of the following
Zyxel Usg Flex 100w Firmware>=4.50<5.37
Zyxel Usg Flex 100w
All of the following
Zyxel USG FLEX 200 firmware>=4.50<5.37
Zyxel USG FLEX 200
All of the following
Zyxel Usg Flex 50 Firmware>=4.50<5.37
Zyxel USG FLEX 50
All of the following
Zyxel USG FLEX 500 firmware>=4.50<5.37
Zyxel USG FLEX 500
All of the following
Zyxel Usg Flex 50w Firmware>=4.50<5.37
Zyxel Usg Flex 50w
All of the following
Zyxel USG FLEX 700 firmware>=4.50<5.37
Zyxel USG FLEX 700
All of the following
Zyxel Zywall Vpn100 Firmware>=4.20<5.37
Zyxel Zywall Vpn100
All of the following
Zyxel Zywall Vpn2s Firmware>=4.20<5.37
Zyxel Zywall Vpn2s
All of the following
Zyxel Zywall Vpn300 Firmware>=4.20<5.37
Zyxel Zywall Vpn300
All of the following
Zyxel Zywall Vpn50 Firmware>=4.20<5.37
Zyxel Zywall Vpn50
All of the following
Zyxel Zywall Vpn 100 Firmware>=4.20<5.37
Zyxel Zywall Vpn 100
All of the following
Zyxel Zywall Vpn 300 Firmware>=4.20<5.37
Zyxel Zywall Vpn 300
All of the following
Zyxel Zywall Vpn 50 Firmware>=4.20<5.37
Zyxel Zywall Vpn 50
Event History
Jul 17, 2023
CVE Published
via MITRE·05:36 PM
Data Sourced
via MITRE·05:36 PM
DescriptionSeverityWeakness
Data Sourced
06:15 PM
DescriptionSeverity
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-34139.
2
What is the severity of CVE-2023-34139?
The severity of CVE-2023-34139 is high.
3
Which Zyxel products are affected by CVE-2023-34139?
Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2 are affected.
4
How can an attacker exploit CVE-2023-34139?
An unauthenticated, LAN-based attacker can exploit CVE-2023-34139 by executing OS commands on an affected device.
5
Is there a fix for CVE-2023-34139?
Yes, users are advised to upgrade their firmware to version 5.37 or above to mitigate the vulnerability.