CVE:CVE-2023-22913
CNNVD:CNNVD-202304-1912
Zyxel USG FLEX是中国合勤（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。
Zyxel USG FLEX 系列 4.50 至 5.35固件版本、VPN 系列 4.30 至 5.35 固件版本存在安全漏洞，该漏洞源于account_operator.cgi CGI 程序中存在通过身份验证后命令注入问题。攻击者利用该漏洞可以修改设备配置数据，从而导致在受影响的设备上出现拒绝服务 (DoS) 情况。
solution:Upgrade zyxel usg_flex_100_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_100w_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_200_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_50_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_50w_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_500_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel usg_flex_700_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn100_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn1000_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn300_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]; Upgrade zyxel vpn50_firmware to a higher version than 5.35,and avoid the version [4.50,5.35]