CVE-2023-22914

A path traversal vulnerability in the “accountprint.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS command...

PT-2023-02: Auth Path Traversal and Command Injection in account_print.cgi in Zyxel products

An issue was identified in Zyxel products affecting: USG FLEX ZLD V4.50-V5.35 и VPN ZLD V4.30-V5.35. Discovered vulnerability in accountprint.cgi can be exploited by an authenticated attacker with administrator privileges to execute unauthorized OS commands in the tmp directory if hotspot functio...