CVE-2023-22913: A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35…

PriorityP351high8.1CVSS 3.1

AVNACLPRLUINSUCNIHAH

EPSS

1.29%

66.9th percentile

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
zyxel	usg_flex_100_firmware	4.50 – 5.35	—
zyxel	usg_flex_100w_firmware	4.50 – 5.35	—
zyxel	usg_flex_200_firmware	4.50 – 5.35	—
zyxel	usg_flex_500_firmware	4.50 – 5.35	—
zyxel	usg_flex_50_firmware	4.50 – 5.35	—
zyxel	usg_flex_50w_firmware	4.50 – 5.35	—
zyxel	usg_flex_700_firmware	4.50 – 5.35	—
zyxel	usg_flex_series_firmware	—	—
zyxel	vpn1000_firmware	4.50 – 5.35	—
zyxel	vpn100_firmware	4.50 – 5.35	—
zyxel	vpn300_firmware	4.50 – 5.35	—
zyxel	vpn50_firmware	4.50 – 5.35	—
zyxel	vpn_series_firmware	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.