Zyxel USG FLEX H Series Firewalls Improper Privilege Management Vulnerability Allowing Privilege Escalation

A vulnerability has been identified in the recovery function of the USG FLEX H series firewalls, specifically in the uOS firmware versions through 1.31. This vulnerability involves improper privilege management, which could enable an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on the affected device.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation on the affected device, allowing the attacker to gain elevated rights and potentially misuse them for malicious purposes.

Remediation

Users are advised to update to the latest firmware version, uOS V1.32, which addresses this vulnerability.