PT-2023-01: Post-auth Command Injection in account_operator.cgi in Zyxel products
Vendor: Zyxel
Vulnerable product: USG FLEX, VPN
Vulnerable version: USG FLEX - ZLD V4.50-V5.35; VPN - ZLD V4.30-V5.35
Vulnerability type:
• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Identifier (ID):
• BDU:2023-03504
• CVE-2023-22913
Vulnerability vector:
• Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Severity (CVSSv3.1): 8.1(high)
• Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
• Severity (CVSSv4.0): 7.2(high)
Description:
An issue was identified in Zyxel products affecting: USG FLEX ZLD (V4.50-V5.35) and VPN (ZLD V4.30-V5.35).
Discovered vulnerability in account_operator.cgi can be exploited by an authenticated attacker to inject commands and modify device configuration data, which could result in a denial of service (DoS) on the affected device.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 25.04.2023
Recommendations:
• Update to version ZLD V5.36 or higher
Additional information:
Researcher: Nikita Abramov (Positive Technologies)