Vulnerability · Published Apr 24, 2023 · Assigned by Zyxel

CVE-2023-22913

High 8.1

In plain English

A high-severity command injection in USG FLEX series firmware from Zyxel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.3%top 29.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.

Affected products (as reported)

Vendor	Product	Versions
Zyxel	USG FLEX series firmware	4.50 through 5.35
Zyxel	VPN series firmware	4.30 through 5.35

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps