CVE-2023-22916
Estado: ModificadaAlta (8.1)—
The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- Puntuación base: 8.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.69%
- Percentil entre todas las CVEs puntuadas: 51
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (18)
Zyxel — Atp100 FirmwareZyxel — Atp100w FirmwareZyxel — Atp200 FirmwareZyxel — Atp500 FirmwareZyxel — Atp700 FirmwareZyxel — Atp800 FirmwareZyxel — USG 20w-vpn FirmwareZyxel — USG Flex 100 FirmwareZyxel — USG Flex 100w FirmwareZyxel — USG Flex 200 FirmwareZyxel — USG Flex 500 FirmwareZyxel — USG Flex 50 FirmwareZyxel — USG Flex 50W FirmwareZyxel — USG Flex 700 FirmwareZyxel — Vpn1000 FirmwareZyxel — Vpn100 FirmwareZyxel — Vpn300 FirmwareZyxel — Vpn50 Firmware
CWE
- CWE-20
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-22916",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-22916",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-04T16:37:35.614852Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 5.2,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 5.2,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@zyxel.com.tw",
"affectedData": [
{
"vendor": "Zyxel",
"product": "ATP series firmware",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG FLEX series firmware",
"versions": [
{
"status": "affected",
"version": "5.00 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG FLEX 50(W) firmware",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG20(W)-VPN firmware",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "VPN series firmware",
"versions": [
{
"status": "affected",
"version": "5.00 through 5.35"
}
]
}
]
}
],
"published": "2023-04-24T17:15:09.767",
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps",
"tags": [
"Vendor Advisory"
],
"source": "security@zyxel.com.tw"
},
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode."
}
],
"lastModified": "2026-06-17T05:36:25.447",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D646F135-E86F-44CF-BD04-3041CFBDE7B6",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C560A27F-849A-427B-98C3-E9DD4952D01F",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F4C2F76-16B0-4695-922E-A4DFB616DCF7",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFACF97D-CEDF-4CEC-931A-30DDB81FE111",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CD56415-0C96-42EA-B214-149D3FF8CB31",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08997853-52B9-4DF2-A1D0-1C2D81850BA0",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74238C9E-D64D-4539-B4BA-FDE47C713EE0",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BA7FE08-56D3-4538-BD83-C721C486796C",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81D90A7B-174F-40A1-8AF4-08B15B7BAC40"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9C932EA-A6CD-4CB6-80AE-2B25351E99DB",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EECD311A-4E96-4576-AADF-47291EDE3559"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "313E3559-F68E-4602-8D52-CC41AD1EC9A2",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C45C303-1A95-4245-B242-3AB9B9106CD4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "786D44ED-568A-456F-A068-97C03C532CCE",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.00"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DFC6353-26D9-48B7-B73E-541619A21E2A",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6BEA412F-3DA1-4E91-9C74-0666147DABCE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B96A47F-C37B-46B2-AAA9-2B9FB1114642",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "426E4382-81ED-438D-ACAB-78CA8993C226",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB3080DC-B3F0-4494-8CA8-8508F76BE273",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBBF5B18-0977-43D8-9FDD-38E039994615",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74E1323C-3010-4E27-9F1C-E0FFF8FED2FC",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F0D40B2-5456-4B59-8A60-66DE573C23F2",
"versionEndIncluding": "5.35",
"versionStartIncluding": "5.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@zyxel.com.tw"
}