CVE-2023-27991
Estado: ModificadaAlta (8.8)—
The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.45%
- Percentil entre todas las CVEs puntuadas: 73
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Zyxel — Atp100 FirmwareZyxel — Atp100w FirmwareZyxel — Atp200 FirmwareZyxel — Atp500 FirmwareZyxel — Atp700 FirmwareZyxel — Atp800 FirmwareZyxel — Usg20-vpn FirmwareZyxel — USG 20w-vpn FirmwareZyxel — USG Flex 100 FirmwareZyxel — USG Flex 100w FirmwareZyxel — USG Flex 200 FirmwareZyxel — USG Flex 500 FirmwareZyxel — USG Flex 50 FirmwareZyxel — USG Flex 50W FirmwareZyxel — USG Flex 700 FirmwareZyxel — Vpn1000 FirmwareZyxel — Vpn100 FirmwareZyxel — Vpn300 FirmwareZyxel — Vpn50 Firmware
CWE
- CWE-78
- CWE-78
Referencias
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-27991",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-27991",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-04T16:47:50.878412Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@zyxel.com.tw",
"affectedData": [
{
"vendor": "Zyxel",
"product": "ATP series firmware",
"versions": [
{
"status": "affected",
"version": "4.32 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG FLEX series firmware",
"versions": [
{
"status": "affected",
"version": "4.50 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG FLEX 50(W) firmware",
"versions": [
{
"status": "affected",
"version": "4.16 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "USG20(W)-VPN firmware",
"versions": [
{
"status": "affected",
"version": "4.16 through 5.35"
}
]
},
{
"vendor": "Zyxel",
"product": "VPN series firmware",
"versions": [
{
"status": "affected",
"version": "4.30 through 5.35"
}
]
}
]
}
],
"published": "2023-04-24T18:15:09.497",
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls",
"tags": [
"Vendor Advisory"
],
"source": "security@zyxel.com.tw"
},
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security@zyxel.com.tw",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely."
}
],
"lastModified": "2026-06-17T05:46:19.873",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84A41F09-4474-4ABC-B2FA-92B17F63A7CA",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73E39B94-291E-4E3A-8A89-B74FF063BA05",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7728D2C4-0B0A-404E-92BC-AAA1A1987BFD",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B7E5F75-5577-4511-A1F4-1BD142D60BD5",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8F79940-F737-4A71-9FAC-1F99E0BCE450",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "791D6928-BE82-4678-A8A4-39C9D9A1C684",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.32"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC95F84E-95A0-4FB8-942A-732E022E3CC6",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07895A23-2B15-4631-A55A-798B35A63E2D",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F65ACDFE-3A54-46D6-98CA-2D51957072AF",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0B8FF81-5020-429E-ABC7-D0F18A5177F5",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD0F817C-6388-41E2-9F80-9B5427036865",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D65F0EC-7ACA-4B80-8D4E-2C1459837D15",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.50"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "224300FB-2462-4E88-A41E-E9E8EAE9CF48",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.16"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6BEA412F-3DA1-4E91-9C74-0666147DABCE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F61480ED-BBF0-49EC-A814-CEFDE1FBFA08",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.16"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7079103C-ED92-40C3-AF42-4689822A96E2",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7239C54F-EC9E-44B4-AE33-1D36E5448219"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB329984-D2A1-40B4-826D-78643B8DD4C8",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "81D90A7B-174F-40A1-8AF4-08B15B7BAC40"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DB62871-BC40-43D8-A486-471CD9316332",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EECD311A-4E96-4576-AADF-47291EDE3559"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0135FFF-62FA-4AEA-8B67-1CCA2D85D8E0",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C45C303-1A95-4245-B242-3AB9B9106CD4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B01FA34A-CA33-48E7-978C-638FC678C9C1",
"versionEndExcluding": "5.36",
"versionStartIncluding": "4.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@zyxel.com.tw"
}