VYPR
← All advisories
High severity7.2NVD Advisory· Published Dec 27, 2020· Updated Jun 17, 2026

CVE-2020-29299

CVE-2020-29299

Description

Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.

Affected products

13
  • Zyxel/Nsg Firmware3 versions
    cpe:2.3:o:zyxel:nsg_firmware:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:zyxel:nsg_firmware:*:*:*:*:*:*:*:*range: <1.33
    • cpe:2.3:o:zyxel:nsg_firmware:1.33:-:*:*:*:*:*:*
    • cpe:2.3:o:zyxel:nsg_firmware:1.33:patch1:*:*:*:*:*:*
  • Zyxel/Usg Flex Firmware
    cpe:2.3:o:zyxel:usg_flex_firmware:-:*:*:*:*:*:*:*
  • Zyxel/VPN Orchestrator2 versions
    cpe:2.3:o:zyxel:vpn_orchestrator:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:zyxel:vpn_orchestrator:*:*:*:*:*:*:*:*range: <10.03
    • (no CPE)range: < SD-OS V10.03 week32
  • Zyxel/Zld
    cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
    Range: <4.39
  • Zyxel/productsdescription
  • Zyxel/NSGllm-create
    Range: < 1.33 patch 4
  • Zyxel/USGllm-fuzzy
    Range: < ZLD V4.39 week38
  • Zyxel/ATPllm-fuzzy
    Range: < ZLD V4.55 week38
  • Zyxel/VPN On-premisellm-fuzzy
    Range: < ZLD V4.39 week38
  • Zyxel/USG FLEXllm-fuzzy
    Range: < ZLD V4.55 week38

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.