CVE-2023-22915
Severity CVSS v4.0:
Pending analysis
Type:
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Publication date:
24/04/2023
Last modified:
04/05/2023
Description
A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* | 4.30 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
To consult the complete list of CPE names with products and versions, see this page