Unrated severityNVD Advisory· Published Apr 24, 2023· Updated Feb 12, 2025

CVE-2023-22914

Description

A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zyxel/USG FLEX 50(W)llm-fuzzy
Range: 4.50 through 5.35
Zyxel/VPN seriesllm-fuzzy2 versions
4.30 through 5.35+ 1 more
- (no CPE)range: 4.30 through 5.35
- (no CPE)range: 4.30 through 5.35
Zyxel/USG FLEX seriescpe-rescue
Range: 4.50 through 5.35

Patches

Vulnerability mechanics

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-apsmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000