VYPR
← Zyxel

Vendor CVEs

Zyxel

All CVEs

341 total · sorted by risk
  • CVE-2023-6398Feb 20, 2024
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37…

  • CVE-2023-6397Feb 20, 2024
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by…

  • CVE-2023-37928Nov 30, 2023
    Zyxel
    NAS326
    risk 0.00cvss —epss 0.60

    A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted…

  • CVE-2023-37927Nov 30, 2023
    Zyxel
    NAS326
    risk 0.00cvss —epss 0.02

    The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to…

  • CVE-2023-35137Nov 30, 2023
    Zyxel
    NAS326
    risk 0.00cvss —epss 0.01

    An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable…

  • CVE-2023-5960Nov 28, 2023
    Zyxel
    USG FLEX series
    risk 0.00cvss —epss 0.00

    An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device.

  • CVE-2023-5797Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware…

  • CVE-2023-5650Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16…

  • CVE-2023-4398Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37,…

  • CVE-2023-4397Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W) series firmware version 5.37, and USG20(W)-VPN series firmware version 5.37, could allow an authenticated local attacker with administrator…

  • CVE-2023-37926Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series…

  • CVE-2023-37925Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware…

  • CVE-2023-35139Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50(W) series firmware versions 5.10 through 5.37, USG20(W)-VPN series firmware versions 5.10…

  • CVE-2023-35136Nov 28, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware…

  • CVE-2023-5593Nov 20, 2023
    Zyxel
    SecuExtender SSL VPN Client
    risk 0.00cvss —epss 0.00

    The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticated local user to gain a privilege escalation by sending a crafted CREATE message.

  • CVE-2023-35140Nov 7, 2023
    Zyxel
    GS1900-24EP
    risk 0.00cvss —epss 0.00

    The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with read-only access to modify system settings on a vulnerable device.

  • CVE-2023-43314Sep 27, 2023
    Zyxel
    PMG2005-T20B
    risk 0.00cvss —epss 0.01

    ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11_C0 could allow an unauthenticated attacker to cause a denial of service condition via a crafted uid.

  • CVE-2023-33013Aug 14, 2023
    Zyxel
    NBG6604
    risk 0.00cvss —epss 0.01

    A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

  • CVE-2023-28768Aug 14, 2023
    Zyxel
    XGS2220-30
    risk 0.00cvss —epss 0.00

    Improper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1), and XS1930-10 firmware version V4.80(ABQE.1) could allow an unauthenticated LAN-based attacker to cause denial-of-service (DoS) conditions by sending…

  • CVE-2023-34141Jul 17, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through 5.36 Patch 2,…

  • CVE-2023-34140Jul 17, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16…

  • CVE-2023-34139Jul 17, 2023
    Zyxel
    VPN series
    risk 0.00cvss —epss 0.01

    A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS…

  • CVE-2023-34138Jul 17, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN…

  • CVE-2023-33011Jul 17, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through…

  • CVE-2023-28767Jul 17, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36,  USG FLEX 50(W) series firmware versions 5.10 through 5.36, USG20(W)-VPN series firmware…

  • CVE-2023-27989Jun 5, 2023
    Zyxel
    NR7101
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote authenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.

  • CVE-2022-45853May 30, 2023
    Zyxel
    GS1900-8
    risk 0.00cvss —epss 0.00

    The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administrator privileges to execute some system commands as 'root' on a vulnerable…

  • CVE-2023-27988May 30, 2023
    Zyxel
    NAS326
    risk 0.00cvss —epss 0.01

    The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device remotely.

  • CVE-2023-22923May 1, 2023
    Zyxel
    Nbg 418n
    risk 0.00cvss —epss 0.01

    A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker to cause denial-of-service (DoS) conditions on an affected device.

  • CVE-2023-22922May 1, 2023
    Zyxel
    Nbg 418n
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated attacker to cause DoS conditions by sending crafted packets if Telnet is enabled on a vulnerable device.

  • CVE-2023-22919May 1, 2023
    Zyxel
    NBG6604
    risk 0.00cvss —epss 0.02

    The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

  • CVE-2023-22921May 1, 2023
    Zyxel
    Nbg 418n
    risk 0.00cvss —epss 0.01

    A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in…

  • CVE-2023-22924May 1, 2023
    Zyxel
    Nbg 418n
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing crafted CLI commands on a vulnerable device.

  • CVE-2023-27991Apr 24, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.02

    The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16…

  • CVE-2023-22914Apr 24, 2023
    Zyxel
    VPN series
    risk 0.00cvss —epss 0.01

    A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute…

  • CVE-2023-22916Apr 24, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00…

  • CVE-2023-22915Apr 24, 2023
    Zyxel
    USG FLEX series
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30…

  • CVE-2023-22913Apr 24, 2023
    Zyxel
    VPN series
    risk 0.00cvss —epss 0.01

    A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify…

  • CVE-2023-22917Apr 24, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32,…

  • CVE-2023-27990Apr 24, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.00

    The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series…

  • CVE-2023-22918Apr 24, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.01

    A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16…

  • CVE-2023-22920Feb 21, 2023
    Zyxel
    LTE3316-M604
    risk 0.00cvss —epss 0.01

    A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfiguration intended for testing purposes. A remote attacker could leverage this vulnerability to access an affected device using Telnet.

  • CVE-2022-45441Feb 7, 2023
    Zyxel
    Nbg 418n
    risk 0.00cvss —epss 0.00

    A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to…

  • CVE-2022-38547Feb 7, 2023
    Zyxel
    ATP series
    risk 0.00cvss —epss 0.03

    A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32…

  • CVE-2022-45854Feb 7, 2023
    Zyxel
    NWA110AX
    risk 0.00cvss —epss 0.00

    An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vulnerable AP were intercepted by the…

  • CVE-2022-45439Jan 17, 2023
    Zyxel
    AX7501-B0
    risk 0.00cvss —epss 0.00

    A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated attacker could use the credentials to access the WLAN service if the configuration file has been retrieved from the…

  • CVE-2022-45440Jan 17, 2023
    Zyxel
    AX7501-B0
    risk 0.00cvss —epss 0.00

    A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system…

  • CVE-2022-43390Jan 11, 2023
    Zyxel
    NR7101
    risk 0.00cvss —epss 0.01

    A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request.

  • CVE-2022-43392Jan 11, 2023
    Zyxel
    NR7101
    risk 0.00cvss —epss 0.01

    A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request.

  • CVE-2022-43393Jan 11, 2023
    Zyxel
    GS1920-24v2
    risk 0.00cvss —epss 0.01

    An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS)…

Page 4 of 7