Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
关键资源的不正确权限授予
Vulnerability Title
Zyxel USG FLEX 安全漏洞
Vulnerability Description
Zyxel USG FLEX是中国合勤（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。 Zyxel USG FLEX V1.32之前版本存在安全漏洞，该漏洞源于PostgreSQL命令权限分配不当，可能导致权限提升。
CVSS Information
N/A
Vulnerability Type
N/A