CVE:CVE-2023-34139
CNNVD:CNNVD-202307-1457
Zyxel USG FLEX是中国合勤（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。
Zyxel USG FLEX 存在安全漏洞，该漏洞源于Free Time WiFi 热点功能中存在命令注入，允许未经身份验证的基于 LAN 的攻击者在受影响的设备上执行操作系统命令。
solution:Upgrade zyxel usg_2200-vpn_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel usg_flex_100_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_100w_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_200_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_50_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_500_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_50w_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel usg_flex_700_firmware to a higher version than 5.37,and avoid the version [4.50,5.37); Upgrade zyxel zywall_vpn100_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn2s_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn300_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn50_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn_100_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn_300_firmware to a higher version than 5.37,and avoid the version [4.20,5.37); Upgrade zyxel zywall_vpn_50_firmware to a higher version than 5.37,and avoid the version [4.20,5.37)