CVE-2023-22914

Vulnerability

A path traversal vulnerability exists in the account_print.cgi CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35 and VPN series firmware versions 4.30 through 5.35. The flaw allows a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the /tmp directory by uploading a crafted file, provided the hotspot function is enabled on the device.

Exploitation

An attacker must have valid administrator credentials and network access to the device (note that WAN access is disabled by default, so LAN or VPN access is typically required). The hotspot feature must be enabled. The attacker uploads a specially crafted file via the account_print.cgi endpoint, exploiting the path traversal to achieve command execution in the /tmp directory.

Impact

Successful exploitation allows the attacker to execute arbitrary OS commands within the /tmp directory, potentially leading to further compromise of the device, including data exfiltration, configuration modification, or denial of service.

Mitigation

Zyxel has released firmware updates to address this vulnerability. Users should upgrade to the latest firmware version as recommended in the vendor advisory [1]. No workarounds are documented; enabling hotspot only when necessary and restricting administrative access can reduce risk.