What’s Vulnerable › Vulnerabilities

CVE-2023-35140

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-07 · updated 2026-06-17
• Weakness: CWE-269

Description

The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

Affected products

• Zyxel GS1900-10HP firmware: through 2.70\(aazi.5\)
• Zyxel GS1900-16 firmware: through 2.70\(aahj.5\)
• Zyxel GS1900-24 firmware: through 2.70\(aahl.5\)
• Zyxel GS1900-24E firmware: through 2.70\(aahk.5\)
• Zyxel GS1900-24EP firmware: through 2.70\(abto.5\)
• Zyxel GS1900-24HPv2 firmware: through 2.70\(abtp.5\)
• Zyxel GS1900-48 firmware: through 2.70\(aahn.5\)
• Zyxel GS1900-48HPv2 firmware: through 2.70\(abtq.5\)
• Zyxel GS1900-8 firmware: through 2.70\(aahh.5\)
• Zyxel GS1900-8HP firmware: through 2.70\(aahi.5\)

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-gs1900-series-switches

Get alerted when CVE-2023-35140 or the next vulnerability affects your stack