What is the CVSS score of CVE-2023-37925?

CVE-2023-37925 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Nwa50Ax Firmware CVE-2023-37925

MEDIUM

Improper Privilege Management (CWE-269)

2023-11-28 security@zyxel.com.tw

Privilege Escalation Zyxel Nwa50Ax Firmware Nwa50Ax Pro Firmware Nwa55Axe Firmware Nwa90Ax Firmware Nwa90Ax Pro Firmware Nwa110Ax Firmware Nwa210Ax Firmware Nwa220Ax 6E Firmware Nwa1123Acv3 Firmware Wac500 Firmware Wac500H Firmware Wax510D Firmware Wax610D Firmware Wax620D 6E Firmware Wax630S Firmware Wax640S 6E Firmware Wax650S Firmware Wax655E Firmware Wbe660S Firmware Zld

5.5

CVSS 3.1 · Vendor: zyxel

Severity by source

Vendor (zyxel) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (zyxel) · only source for this CVE.

CVSS VectorVendor: zyxel

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 28, 2023 - 02:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.

AnalysisAI

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device. Affected products include: Zyxel Zld, Zyxel Nwa110Ax Firmware, Zyxel Nwa1123Acv3 Firmware, Zyxel Nwa210Ax Firmware, Zyxel Nwa220Ax-6E Firmware. Version information: through 5.37.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.