Skip to content
Fencer Vulns
medium 6.5

CVE-2023-22918 json

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FL…

published 2023-04-24 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-27020

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Patch / fix

  • zyxel atp200_firmware 5.36
  • zyxel atp100_firmware 5.36
  • zyxel atp700_firmware 5.36
  • zyxel atp500_firmware 5.36
  • zyxel atp100w_firmware 5.36
  • zyxel atp800_firmware 5.36
  • zyxel usg_flex_100_firmware 5.36
  • zyxel usg_flex_50_firmware 5.36
  • zyxel usg_flex_200_firmware 5.36
  • zyxel usg_flex_500_firmware 5.36
  • zyxel usg_flex_700_firmware 5.36
  • zyxel usg_flex_100w_firmware 5.36
  • zyxel usg_20w-vpn_firmware 5.36
  • zyxel usg_flex_50w_firmware 5.36
  • zyxel usg20-vpn_firmware 5.36
  • zyxel vpn100_firmware 5.36
  • zyxel vpn1000_firmware 5.36
  • zyxel vpn300_firmware 5.36
  • zyxel vpn50_firmware 5.36

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) firmware
  • Zyxel USG20(W)-VPN firmware
  • Zyxel VPN series firmware
  • Zyxel NWA110AX firmware
  • Zyxel WAC500 firmware
  • Zyxel WAX510D firmware

Classification

Weakness
  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.