CVE:CVE-2023-22915
CNNVD:CNNVD-202304-1909
Zyxel USG FLEX是中国合勤（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。
Zyxel USG FLEX 系列 4.50 至 5.35固件版本、USG FLEX 50(W) 4.30 至 5.35 固件版本USG20(W)-VPN 4.30 至 5.35 固件版本、VPN 系列 4.30 至 5.35 固件版本存在安全漏洞，该漏洞源于fbwifi_forward.cgi CGI程序存在缓冲区溢出。攻击者利用该漏洞通过发送特制的HTTP请求来导致拒绝服务条件。
solution:Upgrade zyxel usg_flex_100_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_100w_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_200_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_50_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_50w_firmware to a higher version than 5.35,and avoid the version [4.30,5.35]; Upgrade zyxel usg_flex_500_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_700_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn100_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn1000_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn300_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn50_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_20w-vpn_firmware to a higher version than 5.35,and avoid the version [4.30,5.35]