{"id":"CVE-2023-5960","state":"PUBLISHED","title":"An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through","description":"An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device.","publishedAt":"2023-11-28T02:05:45.830Z","updatedAt":"2024-08-02T08:14:25.225Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"Zyxel"},"assigner":"Zyxel","products":["Zyxel USG FLEX series firmware","Zyxel VPN series firmware"],"affected":[{"vendor":"Zyxel","product":"USG FLEX series firmware","defaultStatus":"unaffected","versions":[{"version":"versions 4.50 through 5.37","status":"affected"}]},{"vendor":"Zyxel","product":"VPN series firmware","defaultStatus":"unaffected","versions":[{"version":"versions 4.30 through 5.37","status":"affected"}]}],"references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5960.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5960","state":"PUBLISHED","datePublished":"2023-11-28T02:05:45.830Z","dateUpdated":"2024-08-02T08:14:25.225Z","assignerShortName":"Zyxel","assignerOrgId":"96e50032-ad0d-4058-a115-4d2c13821f9f","dateReserved":"2023-11-06T01:35:33.602Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device."}],"affected":[{"vendor":"Zyxel","product":"USG FLEX series firmware","defaultStatus":"unaffected","versions":[{"version":"versions 4.50 through 5.37","status":"affected"}]},{"vendor":"Zyxel","product":"VPN series firmware","defaultStatus":"unaffected","versions":[{"version":"versions 4.30 through 5.37","status":"affected"}]}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Zyxel","orgId":"96e50032-ad0d-4058-a115-4d2c13821f9f","dateUpdated":"2023-11-28T02:05:45.830Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:14:25.225Z"}}]}}}