CVE-2023-34139 Command injection in USG FLEX series firmware
Unauthenticated LAN attackers can execute OS commands via the Free Time WiFi hotspot feature in Zyxel USG FLEX and VPN devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34139?
CVE-2023-34139 is a high-severity command injection vulnerability in Zyxel USG FLEX series firmware, published on 17 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.
Weakness: CWE-78
Which versions are affected by CVE-2023-34139?
It affects 15 products.
Products include Zyxel Usg 2200-Vpn Firmware, Zyxel Usg Flex 100 Firmware, Zyxel Usg Flex 100w Firmware, Zyxel Usg Flex 200 Firmware, Zyxel Usg Flex 500 Firmware, Zyxel Usg Flex 50 Firmware and 9 more.
How do I fix CVE-2023-34139?
No fix has been published for CVE-2023-34139 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-34139 being exploited?
There is no known exploitation of CVE-2023-34139 in the wild and no public exploit code.
Sources
Also known as GHSA-xjxm-x67w-v3c7.