CVE-2023-22914
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
24/04/2023
Last modified:
04/05/2023
Description
A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled.
Impact
Base Score 3.x
7.20
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* | ||
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* | 4.50 (including) | 5.35 (including) |
To consult the complete list of CPE names with products and versions, see this page