CVE-2023-35136

Name of the Vulnerable Software and Affected Versions ZyXEL VPN versions 4.30 through 5.37 ZyXEL USG FLEX series firmware versions 4.50 through 5.37 ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37 ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37 ZyXEL ATP series firmware versions 4.32 through 5.37

Description The issue is related to insufficient input validation in the Quagga package of the affected ZyXEL devices. This could allow an authenticated local attacker to access configuration files on an affected device.

Recommendations For ZyXEL VPN versions 4.30 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG FLEX series firmware versions 4.50 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG FLEX 50(W) series firmware versions 4.16 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL USG20(W)-VPN series firmware versions 4.16 through 5.37, update to a version that includes the fix for the improper input validation vulnerability. For ZyXEL ATP series firmware versions 4.32 through 5.37, update to a version that includes the fix for the improper input validation vulnerability.