CVE-2023-22913: Command Injection
First published: Mon Apr 24 2023(Updated: )
A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.
Credit: security@zyxel.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel USG Flex 100 firmware | >=4.50<=5.35 | |
| Zyxel USG Flex 100 firmware | ||
| Zyxel USG FLEX 100w firmware | >=4.50<=5.35 | |
| Zyxel USG FLEX 100w firmware | ||
| Zyxel USG Flex 200HP Firmware | >=4.50<=5.35 | |
| Zyxel USG FLEX 200 firmware | ||
| Zyxel USG FLEX 50(W) series firmware | >=4.50<=5.35 | |
| Zyxel USG FLEX 50w | ||
| Zyxel USG FLEX 50w | >=4.50<=5.35 | |
| Zyxel USG FLEX 50(W) series firmware | ||
| Zyxel USG FLEX 500 | >=4.50<=5.35 | |
| Zyxel USG FLEX 500 firmware | ||
| Zyxel USG FLEX firmware | >=4.50<=5.35 | |
| Zyxel USG FLEX 700 firmware | ||
| Zyxel VPN100 | >=4.50<=5.35 | |
| Zyxel Zywall VPN100 | ||
| Zyxel VPN1000 Firmware | >=4.50<=5.35 | |
| Zyxel VPN1000 Firmware | ||
| Zyxel Zywall VPN 300 Firmware | >=4.50<=5.35 | |
| Zyxel Zywall VPN300 | ||
| Zyxel Zywall VPN 50 Firmware | >=4.50<=5.35 | |
| Zyxel VPN50 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-22913.
What is the severity of CVE-2023-22913?
The severity of CVE-2023-22913 is high with a severity score of 8.1.
What is the affected software of CVE-2023-22913?
The affected software is Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35.
How can a remote authenticated attacker exploit CVE-2023-22913?
A remote authenticated attacker can exploit CVE-2023-22913 through a post-authentication command injection vulnerability in the 'account_operator.cgi' CGI program of Zyxel USG FLEX series firmware.
Is there a fix available for CVE-2023-22913?
Yes, there is a fix available. It is recommended to update the firmware of affected devices to versions higher than 5.35.
- agent/type
- agent/weakness
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/source
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zyxel
- canonical/zyxel usg flex 100 firmware
- version/zyxel usg flex 100 firmware/4.50
- version/zyxel usg flex 100 firmware/5.35
- canonical/zyxel usg flex 100w firmware
- version/zyxel usg flex 100w firmware/4.50
- version/zyxel usg flex 100w firmware/5.35
- canonical/zyxel usg flex 200hp firmware
- version/zyxel usg flex 200hp firmware/4.50
- version/zyxel usg flex 200hp firmware/5.35
- canonical/zyxel usg flex 200 firmware
- canonical/zyxel usg flex 50(w) series firmware
- version/zyxel usg flex 50(w) series firmware/4.50
- version/zyxel usg flex 50(w) series firmware/5.35
- canonical/zyxel usg flex 50w
- version/zyxel usg flex 50w/4.50
- version/zyxel usg flex 50w/5.35
- canonical/zyxel usg flex 500
- version/zyxel usg flex 500/4.50
- version/zyxel usg flex 500/5.35
- canonical/zyxel usg flex 500 firmware
- canonical/zyxel usg flex firmware
- version/zyxel usg flex firmware/4.50
- version/zyxel usg flex firmware/5.35
- canonical/zyxel usg flex 700 firmware
- canonical/zyxel vpn100
- version/zyxel vpn100/4.50
- version/zyxel vpn100/5.35
- canonical/zyxel zywall vpn100
- canonical/zyxel vpn1000 firmware
- version/zyxel vpn1000 firmware/4.50
- version/zyxel vpn1000 firmware/5.35
- canonical/zyxel zywall vpn 300 firmware
- version/zyxel zywall vpn 300 firmware/4.50
- version/zyxel zywall vpn 300 firmware/5.35
- canonical/zyxel zywall vpn300
- canonical/zyxel zywall vpn 50 firmware
- version/zyxel zywall vpn 50 firmware/4.50
- version/zyxel zywall vpn 50 firmware/5.35
- canonical/zyxel vpn50 firmware