CVE-2023-37925: Medium severity zyxel zld firmware vulnerability
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37925?
CVE-2023-37925 is classified as a high severity vulnerability due to improper privilege management in the Zyxel debug CLI command.
How do I fix CVE-2023-37925?
To mitigate CVE-2023-37925, update the affected Zyxel firmware to the latest version provided by Zyxel.
Which Zyxel products are affected by CVE-2023-37925?
CVE-2023-37925 affects multiple Zyxel products including ATP series, USG FLEX series, and USG20(W)-VPN series firmware versions within specified ranges.
What are the potential impacts of CVE-2023-37925?
Exploitation of CVE-2023-37925 could allow unauthorized access to sensitive functionalities within the affected Zyxel devices.
When was CVE-2023-37925 discovered?
CVE-2023-37925 was publicly disclosed in 2023, revealing critical vulnerabilities in multiple Zyxel firmware versions.