What’s Vulnerable › Vulnerabilities

CVE-2023-37925

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-28 · updated 2026-06-17
• Weakness: CWE-269

Description

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.

Affected products

• Zyxel NWA110AX firmware: before 6.70\(abtg.0\) — fixed in 6.70\(abtg.0\)
• Zyxel NWA1123ACv3 firmware: before 6.70\(abvt.0\) — fixed in 6.70\(abvt.0\)
• Zyxel Nwa210Ax Firmware: before 6.70\(abtd.0\) — fixed in 6.70\(abtd.0\)
• Zyxel Nwa220Ax-6E Firmware: before 6.70\(acco.0\) — fixed in 6.70\(acco.0\)
• Zyxel Nwa50Ax-Pro Firmware: before 6.80\(acge.0\) — fixed in 6.80\(acge.0\)
• Zyxel NWA50AX firmware: before 6.80\(abyw.0\) — fixed in 6.80\(abyw.0\)
• Zyxel Nwa55Axe Firmware: before 6.80\(abzl.0\) — fixed in 6.80\(abzl.0\)
• Zyxel Nwa90Ax-Pro Firmware: before 6.80\(acgf.0\) — fixed in 6.80\(acgf.0\)
• Zyxel Nwa90Ax Firmware: before 6.80\(accv.0\) — fixed in 6.80\(accv.0\)
• Zyxel WAC500 firmware: before 6.70\(abvs.0\) — fixed in 6.70\(abvs.0\)
• Zyxel Wac500H Firmware: before 6.70\(abwa.0\) — fixed in 6.70\(abwa.0\)
• Zyxel WAX510D firmware: before 6.70\(abtf.0\) — fixed in 6.70\(abtf.0\)
• Zyxel Wax610D Firmware: before 6.70\(abte.0\) — fixed in 6.70\(abte.0\)
• Zyxel Wax620D-6E Firmware: before 6.70\(accn.0\) — fixed in 6.70\(accn.0\)
• Zyxel Wax630S Firmware: before 6.70\(abzd.0\) — fixed in 6.70\(abzd.0\)
• Zyxel Wax640S-6E Firmware: before 6.70\(accm.0\) — fixed in 6.70\(accm.0\)
• Zyxel WAX650S firmware: before 6.70\(abrm.0\) — fixed in 6.70\(abrm.0\)
• Zyxel WAX655E firmware: before 6.70\(acdo.0\) — fixed in 6.70\(acdo.0\)
• Zyxel WBE660S firmware: before 6.70\(acgg.0\) — fixed in 6.70\(acgg.0\)
• Zyxel firewall (ZLD): from 4.32 through 5.37; from 4.50 through 5.37; from 4.16 through 5.37; from 4.30 through 5.37

How to fix

Upgrade to a fixed version: Zyxel NWA110AX firmware 6.70\(abtg.0\); Zyxel NWA1123ACv3 firmware 6.70\(abvt.0\); Zyxel Nwa210Ax Firmware 6.70\(abtd.0\); Zyxel Nwa220Ax-6E Firmware 6.70\(acco.0\); Zyxel Nwa50Ax-Pro Firmware 6.80\(acge.0\); Zyxel NWA50AX firmware 6.80\(abyw.0\); Zyxel Nwa55Axe Firmware 6.80\(abzl.0\); Zyxel Nwa90Ax-Pro Firmware 6.80\(acgf.0\); Zyxel Nwa90Ax Firmware 6.80\(accv.0\); Zyxel WAC500 firmware 6.70\(abvs.0\); Zyxel Wac500H Firmware 6.70\(abwa.0\); Zyxel WAX510D firmware 6.70\(abtf.0\). Check the vendor advisory for mitigations.

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps

Get alerted when CVE-2023-37925 or the next vulnerability affects your stack