CVE-2023-4957 is a medium-severity authentication-bypass flaw (CWE-288) in Zebra Technologies' ZT410 industrial ZPL label printer: an attacker on the same network as the device can send a specially crafted POST request to the printer's setvarsResults.cgi web endpoint and overwrite the administrator username and password for the device's web management page, as long as the printer's Protected Mode setting has not been turned on, and NVD has published its own Primary CVSS v3.1 score of 4.3 for the flaw.
Vulnerability summary
4.3
Medium
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2023-10-11
Published
Vulnerability ID: CVE-2023-4957 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Zebra Technologies ZT410 series industrial thermal label/barcode printer (ZPL firmware) | — | ZT410-203dpi with firmware build 18J150703184, per NVD's description; per Spain's INCIBE-CERT, mitigated by enabling Protected Mode (available since Link-OS v6.0, disabled by default) or updating to Link-OS v7.3 or later |
What does this mean for affected devices?
CVE-2023-4957 (CWE-288, authentication bypass using an alternate path or channel) affects Zebra Technologies' ZT410-203dpi ZPL industrial label printer. NVD's description states: "A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled" (NVD).
NVD lists its own Primary CVSS v3.1 base score of 4.3 (medium), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. That is a notch lower than the Secondary score submitted by Spain's INCIBE-CERT, the coordinator that first reported the flaw: CVSS v3.1 5.4 (medium), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N — NVD's own analysis rates the confidentiality impact as none rather than low, since the flaw lets an attacker overwrite credentials rather than read existing ones (NVD).
INCIBE-CERT's advisory (tracked internally as INCIBE-2023-0434) explains that Zebra's Link-OS firmware has included a "Protected Mode" feature since version 6.0 that is meant to prevent exactly this kind of unauthorized configuration change, but that Protected Mode ships disabled by default, which is why the printer remains exploitable out of the box. The advisory's Solution section states that Zebra later released Link-OS v7.3 (dated March 2025) with a fix, and that the currently available firmware is Link-OS v7.4 (INCIBE-CERT advisory).
The same INCIBE-CERT advisory notes that the ZT410 model itself was discontinued by Zebra on October 1, 2020, with end-of-support dates falling between September and December 2025 depending on region — meaning organizations still running this printer are relying on hardware nearing or past its vendor support window even where the Protected Mode or firmware mitigation has been applied (INCIBE-CERT advisory).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0030 (23.0th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
Any Zebra ZT410 (or related ZPL-based Zebra label printer sharing the same web-management interface) that has not had Protected Mode enabled, and that has not been updated to Link-OS v7.3 or later, should be treated as vulnerable to having its admin credentials overwritten by any device on the same network segment.
Evidence
- An attacker on the same network as a Zebra ZTC ZT410-203dpi ZPL printer can change the device's web-page username and password via a crafted POST request to setvarsResults.cgi, exploitable only when the printer's Protected Mode is disabled. — NVD
- NVD Primary CVSS v3.1 base score 4.3, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N; differs from INCIBE-CERT's Secondary CVSS v3.1 5.4 (AV:A, C:L) submission. — NVD
- Link-OS has included a Protected Mode feature since v6.0 to prevent this class of change, but it is disabled by default; Zebra's fix shipped in Link-OS v7.3 (March 2025), with v7.4 the current release. — INCIBE-CERT advisory
- The ZT410 was discontinued by Zebra on October 1, 2020, with end-of-support dates between September and December 2025 depending on region. — INCIBE-CERT advisory
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0030 (23.0th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker actually do if they exploit CVE-2023-4957?
An attacker on the same network as a vulnerable Zebra ZT410 printer can send a crafted POST request to the device's setvarsResults.cgi endpoint and overwrite the username and password used to log into the printer's web management page, locking out the legitimate administrator or gaining control of the device's configuration (per NVD; per INCIBE-CERT).
Does the printer need a special setting disabled for this attack to work?
Yes. NVD's description says the flaw is exploitable only when the printer's 'protected mode' is disabled. INCIBE-CERT's advisory notes Zebra's Link-OS firmware has shipped a Protected Mode feature since version 6.0 specifically to block this kind of change, but that it is disabled by default, so an unconfigured printer remains exposed (per NVD; per INCIBE-CERT).
Has Zebra released a firmware fix for this vulnerability?
Per INCIBE-CERT's advisory, Zebra released Link-OS v7.3 (dated March 2025) with a fix, and the currently available firmware is Link-OS v7.4; the ZT410 model itself was discontinued on October 1, 2020, with vendor support ending between September and December 2025 depending on region (per INCIBE-CERT).