VYPR
← All vendors
Vendor

Zyxel

Zyxel Communications Corporation, a subsidiary of Zyxel Group Corporation, is a Taiwanese multinational broadband provider headquartered in the Hsinchu Science Park, Taiwan. The company was founded in 1989 by Shun-I Chu, and has three research centers, four regional headquarters, and 35 branch offices.

Founded 1989
Products
606
CVEs
339
Across products
876
Status
Private

Products

606
View all 606 products →

Recent CVEs

339
View all 339 CVEs →
  • CVE-2023-28771CriKEVApr 25, 2023
    Zyxel
    ATP series
    risk 0.87cvss 9.8epss 0.99

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an…

  • CVE-2022-30525CriKEVMay 12, 2022
    Zyxel
    Usg Flex 200 Firmware
    risk 0.87cvss 9.8epss 1.00

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00…

  • CVE-2017-18368CriKEVMay 2, 2019
    Zyxel
    P660HN-T1A
    risk 0.86cvss 9.8epss 0.95

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page…

  • CVE-2020-9054CriKEVMar 4, 2020
    Zyxel
    NAS326
    risk 0.84cvss 9.8epss 1.00

    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve…

  • CVE-2020-29583CriKEVDec 22, 2020
    Zyxel
    USG
    risk 0.83cvss 9.8epss 0.90

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin…

  • CVE-2023-27992CriKEVJun 19, 2023
    Zyxel
    Nas326 Firmware
    risk 0.82cvss 9.8epss 0.84

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to…

  • CVE-2017-6884HigKEVApr 6, 2017
    Zyxel
    EMG2926
    risk 0.81cvss 8.8epss 0.38

    A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands…

  • CVE-2023-33010CriKEVMay 24, 2023
    Zyxel
    ATP series firmware
    risk 0.78cvss 9.8epss 0.29

    A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions…

  • CVE-2023-33009CriKEVMay 24, 2023
    Zyxel
    ATP series firmware
    risk 0.78cvss 9.8epss 0.28

    A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions…

  • CVE-2021-4039CriMar 1, 2022
    Zyxel
    NWA-1100-NH
    risk 0.72cvss 9.8epss 0.71

    A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.

  • CVE-2024-40891HigKEVFeb 4, 2025
    Zyxel
    VMG4325-B10A
    risk 0.71cvss 8.8epss 0.22

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on…

  • CVE-2024-40890HigKEVFeb 4, 2025
    Zyxel
    VMG4325-B10A
    risk 0.71cvss 8.8epss 0.22

    **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected…

  • CVE-2024-29973CriJun 4, 2024
    Zyxel
    Nas326 Firmware
    risk 0.71cvss 9.8epss 0.86

    ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating…

  • CVE-2024-29972CriJun 4, 2024
    Zyxel
    Nas326 Firmware
    risk 0.71cvss 9.8epss 0.89

    ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some…

  • CVE-2022-0342CriMar 28, 2022
    Zyxel
    ATP series
    risk 0.70cvss 9.8epss 0.84

    An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG…

  • CVE-2017-18371CriMay 2, 2019
    Zyxel
    P660HN-T1A
    risk 0.69cvss 9.8epss 0.23

    The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234.…

  • CVE-2015-6018CriDec 31, 2015
    Zyxel
    PMG5318-B20A
    risk 0.68cvss 9.8epss 0.21

    The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.

  • CVE-2008-1160CriMar 25, 2008
    Zyxel
    ZyWALL 1050
    risk 0.68cvss 9.8epss 0.15

    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to gain privileges.

  • CVE-2024-11667HigKEVNov 27, 2024
    Zyxel
    ATP series
    risk 0.67cvss 7.5epss 0.03

    A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series…

  • CVE-2023-4473CriNov 30, 2023
    Zyxel
    Nas326 Firmware
    risk 0.67cvss 9.8epss 0.41

    A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable…

View all 339 CVEs →