CVE-2021-35028

Description

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

h zyxel zywall_vpn2s -*******

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_VPN2S_Firewall.shtml

PatchVendor Advisory

CvssV3 impact

BaseSeverity	HIGH
ConfidentialityImpact	HIGH
AttackComplexity	LOW
Scope	UNCHANGED
AttackVector	LOCAL
AvailabilityImpact	HIGH
IntegrityImpact	HIGH
PrivilegesRequired	LOW
BaseScore	7.8
VectorString	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version	3.1
UserInteraction	NONE

CvssV2 impact

AccessComplexity	LOW
ConfidentialityImpact	COMPLETE
AvailabilityImpact	COMPLETE
IntegrityImpact	COMPLETE
BaseScore	7.2
VectorString	AV:L/AC:L/Au:N/C:C/I:C/A:C
Version	2.0
AccessVector	LOCAL
Authentication	NONE

Created by Yello

About Severity.io