CVE-2017-17550

The vulnerability is in ZyXEL ZyWALL USG devices (2.12 AQQ.2 and 3.30 AQQ.7) where a CSRF flaw in the cgi-bin/zysh-cgi cmd action allows an attacker to add a user account. This newly created account could subsequently be used to perform stored XSS, as described in multiple sources. Affected softw...