CVE-2023-22913

Vulnerability

A post-authentication command injection vulnerability exists in the account_operator.cgi CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35 [1]. The vulnerability allows a remote authenticated attacker to inject arbitrary commands, which can be leveraged to modify device configuration data [1].

Exploitation

An attacker must have valid authentication credentials and network access to the device's management interface. WAN access is disabled by default, so the attacker typically needs to be on a local network or have VPN access [1]. The attacker sends a crafted HTTP request to the account_operator.cgi endpoint with malicious command injection payloads [1].

Impact

Successful exploitation enables the attacker to modify device configuration data, leading to denial-of-service (DoS) conditions on the affected device [1]. The device may become unresponsive or lose connectivity, disrupting normal operations [1].

Mitigation

Zyxel has released firmware updates to address this vulnerability. Users should upgrade to the latest firmware version as specified in the security advisory [1]. No workarounds are documented; enabling only trusted management access and restricting network exposure can reduce risk.