Command injection

2023-07-1718:15:00

PRIOn knowledge base

www.prio-n.com

zyxel

usg

flex

vpn

command injection

firmware

vulnerability

os commands

lan-based attacker

8.9 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.8%

JSON

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device.

CPENameOperatorVersion
usg_2200-vpn_firmwarege4.20
usg_2200-vpn_firmwarelt5.37
usg_flex_100_firmwarege4.50
usg_flex_100_firmwarelt5.37
usg_flex_100w_firmwarege4.50
usg_flex_100w_firmwarelt5.37
usg_flex_200_firmwarege4.50
usg_flex_200_firmwarelt5.37
usg_flex_500_firmwarege4.50
usg_flex_500_firmwarelt5.37

Name	Operator	Version
usg_2200-vpn_firmware	ge	4.20
usg_2200-vpn_firmware	lt	5.37
usg_flex_100_firmware	ge	4.50
usg_flex_100_firmware	lt	5.37
usg_flex_100w_firmware	ge	4.50
usg_flex_100w_firmware	lt	5.37
usg_flex_200_firmware	ge	4.50
usg_flex_200_firmware	lt	5.37
usg_flex_500_firmware	ge	4.50
usg_flex_500_firmware	lt	5.37