Skip to content
Fencer Vulns
high 7.2

CVE-2023-6398 json

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.3…

published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58635

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1,

USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,

NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.

Patch / fix

  • zyxel usg_flex_700_firmware 5.37_patch1
  • zyxel nwa50ax_firmware 6.29\(abyw.4\)
  • zyxel wac500_firmware 6.70\(abvs.1\)
  • zyxel wax300h_firmware 6.70\(achf.1\)
  • zyxel wbe660s_firmware 6.70\(acgg.1\)

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel ATP series firmware
  • Zyxel USG FLEX series firmware
  • Zyxel USG FLEX 50(W) series firmware
  • Zyxel USG20(W)-VPN series firmware
  • Zyxel NWA50AX firmware
  • Zyxel WAC500 firmware
  • Zyxel WAX300H firmware
  • Zyxel WBE660S firmware
  • Zyxel USG FLEX H series firmware
  • zyxel atp800_firmware
  • zyxel usg_flex_700_firmware
  • zyxel nwa50ax_firmware
  • zyxel wac500_firmware
  • zyxel wax300h_firmware
  • zyxel wbe660s_firmware
  • zyxel usg_20w-vpn_firmware

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.