CVE-2023-22913: Command Injection

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-22913.

Q: What is the severity of CVE-2023-22913?

The severity of CVE-2023-22913 is high with a severity score of 8.1.

Q: What is the affected software of CVE-2023-22913?

The affected software is Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35.

Q: How can a remote authenticated attacker exploit CVE-2023-22913?

A remote authenticated attacker can exploit CVE-2023-22913 through a post-authentication command injection vulnerability in the 'account_operator.cgi' CGI program of Zyxel USG FLEX series firmware.

Q: Is there a fix available for CVE-2023-22913?

Yes, there is a fix available. It is recommended to update the firmware of affected devices to versions higher than 5.35.

Published Apr 24, 2023

Updated

A post-authentication command injection vulnerability in the “accountoperator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.

Affected Software

22 affected components

Zyxel Usg Flex 100 Firmware>=4.50<=5.35

Zyxel Usg Flex 100

Zyxel Usg Flex 100w Firmware>=4.50<=5.35

Zyxel Usg Flex 100w

Zyxel USG FLEX 200 firmware>=4.50<=5.35

Zyxel USG FLEX 200

Zyxel Usg Flex 50 Firmware>=4.50<=5.35

Zyxel USG FLEX 50

Zyxel Usg Flex 50w Firmware>=4.50<=5.35

Zyxel Usg Flex 50w

Zyxel USG FLEX 500 firmware>=4.50<=5.35

Zyxel USG FLEX 500

Zyxel USG FLEX 700 firmware>=4.50<=5.35

Zyxel USG FLEX 700

Zyxel Vpn100 Firmware>=4.50<=5.35

Zyxel Vpn100

Zyxel Vpn1000 Firmware>=4.50<=5.35

Zyxel Vpn1000

Zyxel Vpn300 Firmware>=4.50<=5.35

Zyxel Vpn300

Zyxel Vpn50 Firmware>=4.50<=5.35

Zyxel Vpn50

Event History

Apr 24, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-22913.

What is the severity of CVE-2023-22913?

The severity of CVE-2023-22913 is high with a severity score of 8.1.

What is the affected software of CVE-2023-22913?

The affected software is Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35.

How can a remote authenticated attacker exploit CVE-2023-22913?

A remote authenticated attacker can exploit CVE-2023-22913 through a post-authentication command injection vulnerability in the 'account_operator.cgi' CGI program of Zyxel USG FLEX series firmware.

Is there a fix available for CVE-2023-22913?