An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG…

Description

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access the administrator’s logs on an affected device.

Scores

EPSS (exploitation in 30 days)

0.21% · top 88% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• CWE-269 Improper Privilege Management (opens in a new tab)All about CWE-269 and its CVEs

Affected products

• Zyxel · ATP series firmware

  • affected versions 4.32 through 5.37

• Zyxel · USG FLEX series firmware

  • affected versions 4.50 through 5.37

• Zyxel · USG FLEX 50(W) series firmware

  • affected versions 4.16 through 5.37

• Zyxel · USG20(W)-VPN series firmware

  • affected versions 4.16 through 5.37

• Zyxel · VPN series firmware

  • affected versions 4.30 through 5.37

• Zyxel · NWA50AX firmware

  • affected 6.29(ABYW.2)

• Zyxel · WAC500 firmware

  • affected 6.65(ABVS.1)

• Zyxel · WAX300H firmware

  • affected 6.60(ACHF.1)

• Zyxel · WBE660S firmware

  • affected 6.65(ACGG.1)

References (1)

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-5797](https://trackcve.app/badge/CVE-2023-5797.svg)](https://trackcve.app/cve/CVE-2023-5797)

Record last updated 2 Dec 2024, 19:31 UTC.