Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2024-7203 Details
Description
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device by executing a crafted CLI command.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 3, 2024Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zyxel zld | >= 4.60, < 5.39 |
CPE
Remediation
| |
| zyxel atp100 | All versions |
CPE
Remediation
| |
| zyxel atp100w | All versions |
CPE
Remediation
| |
| zyxel atp200 | All versions |
CPE
Remediation
| |
| zyxel atp500 | All versions |
CPE
Remediation
| |
| zyxel atp700 | All versions |
CPE
Remediation
| |
| zyxel atp800 | All versions |
CPE
Remediation
| |
| zyxel usg flex 100 | All versions |
CPE
Remediation
| |
| zyxel usg flex 100ax | All versions |
CPE
Remediation
| |
| zyxel usg flex 100w | All versions |
CPE
Remediation
| |
| zyxel usg flex 200 | All versions |
CPE
Remediation
| |
| zyxel usg flex 50 | All versions |
CPE
Remediation
| |
| zyxel usg flex 500 | All versions |
CPE
Remediation
| |
| zyxel usg flex 50w | All versions |
CPE
Remediation
| |
| zyxel usg flex 700 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 13, 2024 | Reanalysis | [email protected] |
| Sep 5, 2024 | Initial Analysis | [email protected] |
| Sep 3, 2024 | New CVE Received | [email protected] |