CVE-2023-22918 Information disclosure in ATP series firmware

Medium 6.5 Published 24 Apr 2023 Updated 12 Feb 2025

Authenticated attackers can retrieve encrypted administrator information from Zyxel network devices via a CGI program vulnerability.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-22918?

CVE-2023-22918 is a medium-severity vulnerability in Zyxel ATP series firmware, published on 24 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Weakness: CWE-359

Which versions are affected by CVE-2023-22918?

It affects 51 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 45 more.

How do I fix CVE-2023-22918?

No fix has been published for CVE-2023-22918 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-22918 being exploited?

There is no known exploitation of CVE-2023-22918 in the wild and no public exploit code.

Sources

Also known as GHSA-q9h2-893q-85gq.