What is the CVSS score of CVE-2023-22918?

CVE-2023-22918 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2023-22918?

Yes, a patch is available for CVE-2023-22918. Update the affected software to the latest version immediately.

Atp200 Firmware CVE-2023-22918

MEDIUM

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2023-04-24 security@zyxel.com.tw

Information Disclosure Zyxel Atp200 Firmware Atp100 Firmware Atp700 Firmware Atp500 Firmware Atp100W Firmware Atp800 Firmware Usg Flex 100 Firmware Usg Flex 50 Firmware Usg Flex 200 Firmware Usg Flex 500 Firmware Usg Flex 700 Firmware Usg Flex 100W Firmware Usg 20W Vpn Firmware Usg Flex 50W Firmware Usg20 Vpn Firmware Vpn100 Firmware Vpn1000 Firmware Vpn300 Firmware Vpn50 Firmware Nap203 Firmware Nap303 Firmware Nap353 Firmware Nwa110Ax Firmware Nwa1123 Ac Hd Firmware Nwa1123 Ac Pro Firmware Nwa1123Acv3 Firmware Nwa210Ax Firmware Nwa220Ax 6E Firmware Nwa50Ax Firmware Nwa50Ax Pro Firmware Nwa5123 Ac Hd Firmware Nwa55Axe Firmware Nwa90Ax Firmware Nwa90Ax Pro Firmware Wac500 Firmware Wac500H Firmware Wac5302D Sv2 Firmware Wac6103D I Firmware Wac6303D S Firmware Wac6502D E Firmware Wac6502D S Firmware Wac6503D S Firmware Wac6552D S Firmware Wac6553D E Firmware Wax510D Firmware Wax610D Firmware Wax620D 6E Firmware Wax630S Firmware Wax640S 6E Firmware Wax650S Firmware Wax655E Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 24, 2023 - 18:15 nvd

MEDIUM 6.5

DescriptionNVD

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-359. A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device. Affected products include: Zyxel Atp200 Firmware, Zyxel Atp100 Firmware, Zyxel Atp700 Firmware, Zyxel Atp500 Firmware, Zyxel Atp100W Firmware. Version information: through 5.35.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.