Skip to main content

Gs1900 48Hpv2 Firmware CVE-2023-35140

MEDIUM
Improper Privilege Management (CWE-269)
2023-11-07 security@zyxel.com.tw
Privilege Escalation Zyxel Gs1900 48Hpv2 Firmware Gs1900 48 Firmware Gs1900 24Hpv2 Firmware Gs1900 24Ep Firmware Gs1900 24E Firmware Gs1900 24 Firmware Gs1900 16 Firmware Gs1900 10Hp Firmware Gs1900 8Hp Firmware Gs1900 8 Firmware
5.5
CVSS 3.1 · Vendor: zyxel
Share

Severity by source

Vendor (zyxel) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (zyxel) · only source for this CVE.

CVSS VectorVendor: zyxel

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 07, 2023 - 05:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

AnalysisAI

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device. Affected products include: Zyxel Gs1900-48Hpv2 Firmware, Zyxel Gs1900-48 Firmware, Zyxel Gs1900-24Hpv2 Firmware, Zyxel Gs1900-24Ep Firmware, Zyxel Gs1900-24E Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Gs1900 48Hpv2 Firmware

View all
CVE-2026-7273 HIGH
8.8 Jun 16

Remote code execution in Zyxel GS1900 series managed switches (including GS1900-48HPv2, GS1900-8, GS1900-8HP, GS1900-10H
CVE-2021-35031 HIGH
8.0 Dec 28

A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware
CVE-2021-35032 HIGH
7.8 Dec 28

A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local u
CVE-2024-8881 MEDIUM
6.8 Nov 12

A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version

CVE-2024-38270 MEDIUM
6.5 Sep 10

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authe
CVE-2022-34746 MEDIUM
5.9 Sep 20

An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair
CVE-2024-8882 MEDIUM
4.5 Nov 12

A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and ea
CVE-2021-35030 MEDIUM
4.3 Jul 26

A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize p

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2016-0151 HIGH POC
7.8
CVE-2013-0643 HIGH
8.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2023-35140 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy