What is CVE-2023-5960?

CVE-2023-5960 is a medium-severity vulnerability in Zyxel Usg_flex_100, classified under Improper Privilege Management. CVSS score: 5.5/10. Published 2023-11-28.

How severe is CVE-2023-5960?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Privilege escalation in Zyxel Usg_flex_100

CVE-2023-5960

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access…

Vulnerability class: Privilege Escalation

EPSS: 0.002 (12.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Zyxel Usg_flex_100
Zyxel Usg_flex_100w
Zyxel Usg_flex_200
Zyxel Usg_flex_50
Zyxel Usg_flex_500
Zyxel Usg_flex_50w
Zyxel Usg_flex_700
Zyxel Usg Flex Series Firmware — versions versions 4.50 through 5.37
Zyxel Vpn100
Zyxel Vpn1000

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

security@zyxel.com.tw (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-5960?: CVE-2023-5960 is a medium-severity vulnerability in Zyxel Usg_flex_100, classified under Improper Privilege Management. CVSS score: 5.5/10. Published 2023-11-28.
How severe is CVE-2023-5960?: Medium severity. CVSS v3 base score is 5.5 out of 10.