CVE-2023-35140 : The improper privilege management vulnerability in the Zyxel GS1900-24EP switch

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

Published 2023-11-07 05:15:12

Updated 2023-11-14 18:27:19

Source Zyxel Corporation

View at NVD, CVE.org

Products affected by CVE-2023-35140

Zyxel » Gs1900-8 Firmware
Versions up to, including, (<=) 2.70\(aahh.5\)
cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-8 » Version: N/A
Zyxel » Gs1900-24 Firmware
Versions up to, including, (<=) 2.70\(aahl.5\)
cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24 » Version: N/A
Zyxel » Gs1900-8hp Firmware
Versions up to, including, (<=) 2.70\(aahi.5\)
cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-8hp » Version: N/A
Zyxel » Gs1900-10hp Firmware
Versions up to, including, (<=) 2.70\(aazi.5\)
cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-10hp » Version: N/A
Zyxel » Gs1900-16 Firmware
Versions up to, including, (<=) 2.70\(aahj.5\)
cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-16 » Version: N/A
Zyxel » Gs1900-24e Firmware
Versions up to, including, (<=) 2.70\(aahk.5\)
cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24e » Version: N/A
Zyxel » Gs1900-48 Firmware
Versions up to, including, (<=) 2.70\(aahn.5\)
cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-48 » Version: N/A
Zyxel » Gs1900-24ep Firmware
Versions up to, including, (<=) 2.70\(abto.5\)
cpe:2.3:o:zyxel:gs1900-24ep_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24ep » Version: N/A
Zyxel » Gs1900-24hpv2 Firmware
Versions up to, including, (<=) 2.70\(abtp.5\)
cpe:2.3:o:zyxel:gs1900-24hpv2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-24hpv2 » Version: N/A
Zyxel » Gs1900-48hpv2 Firmware
Versions up to, including, (<=) 2.70\(abtq.5\)
cpe:2.3:o:zyxel:gs1900-48hpv2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Gs1900-48hpv2 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-35140

EPSS FAQ

We don't have an EPSS score for this CVE yet

CVSS scores for CVE-2023-35140

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	1.8	3.6	Zyxel Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2023-35140

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: security@zyxel.com.tw (Secondary)

References for CVE-2023-35140

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches

Zyxel security advisory for improper privilege management vulnerability in GS1900 series switches | Zyxel Networks
Not Applicable;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-35140

Products affected by CVE-2023-35140

Exploit prediction scoring system (EPSS) score for CVE-2023-35140

CVSS scores for CVE-2023-35140

CWE ids for CVE-2023-35140

References for CVE-2023-35140