CVE-2023-22914

CWE-22 — Path Traversal3 documents3 sources
Severity
7.2HIGH
EPSS
1.0%
top 23.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Zyxel USG Flex 100 FirmwareZyxel USG Flex 100w FirmwareZyxel USG Flex 200 Firmware+10 more
Timeline
PublishedApr 24
Latest updateJul 6

Description

A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages13 packages

▶CVEListV5zyxel/usg_flex_series_firmware4.50 through 5.35
▶CVEListV5zyxel/vpn_series_firmware4.30 through 5.35
▶NVDzyxel/usg_flex_50_firmware4.50 — 5.35
▶NVDzyxel/usg_flex_100_firmware4.50 — 5.35
▶NVDzyxel/usg_flex_200_firmware4.50 — 5.35

🔴Vulnerability Details

2
GHSA
GHSA-3pc2-c878-63rj: A path traversal vulnerability in the “account_print↗2023-07-06
▶
CVEList
CVE-2023-22914: A path traversal vulnerability in the “account_print↗2023-04-24
▶
CVE-2023-22914 (HIGH CVSS 7.2) | A path traversal vulnerability in t | cvebase.io