CVE-2023-22915
High
Description
A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Zyxel Usg Flex 100 Firmware
PublishedApr 24, 2023
First seenApr 24, 2023
Weakness typeCWE-120CWE-120
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel usg_flex_100_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_100w_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_200_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_50_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_50w_firmware | 4.30 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_500_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_flex_700_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel vpn100_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel vpn1000_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel vpn300_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel vpn50_firmware | 4.50 ≤ v ≤ 5.35 | — |
| zyxel usg_20w-vpn_firmware | 4.30 ≤ v ≤ 5.35 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.