Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38 VPN Orchestrator before SD-OS V10.03 week32 USG before ZLD V4.39 week38 USG FLEX before ZLD V4.55 week38 ATP before ZLD V4.55 week38 and NSG before 1.33 patch 4.