Read the docs

Zyxel

Records341All Threatist records
Exploited (KEV)13In CISA KEV
CVSS critical64CVSS 9.0–10.0
CVSS high136CVSS 7.0–8.9

Exploited now

Zyxel records in CISA KEV
TI-2026-06387 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Priority CRITICAL 97KEV 2026-09-21TI-2024-27255 Zyxel DSL CPE OS Command Injection Vulnerability Priority CRITICAL 97KEV 2025-02-11TI-2024-27256 Zyxel DSL CPE OS Command Injection Vulnerability Priority CRITICAL 97KEV 2025-02-11TI-2024-10813 Zyxel Multiple Firewalls Path Traversal Vulnerability Priority CRITICAL 99KEV 2024-12-03TI-2017-04616 Zyxel EMG2926 Routers Command Injection Vulnerability Priority CRITICAL 97KEV 2023-09-18TI-2017-13541 Zyxel P660HN-T1A Routers Command Injection Vulnerability Priority CRITICAL 100KEV 2023-08-07

Components

Products in the NVD configurations · select one to filter the records
Cloudcnm Secumanager 35 records MEDIUM Gs1900-10hp Firmware 35 records CRITICAL Usg Flex 100w Firmware 34 records CRITICAL Usg Flex 200 Firmware 34 records CRITICAL Usg Flex 500 Firmware 34 records CRITICAL Usg Flex 700 Firmware 34 records CRITICAL Usg Flex 100 Firmware 30 records CRITICAL Emg3525-t50b Firmware 28 records MEDIUM

Records

24 records in Atp100 Firmware · all components

TI-2023-16198 CVE-2023-33010 · GHSA-fqv9-84fh-jjgr

Buffer overflow in Zyxel ATP series firmware

Priority CRITICAL 100KEV

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29024 Published 2023-05-24 No fix listed CWE-120
TI-2023-16197 CVE-2023-33009 · GHSA-g3f9-6h7x-x69v

Buffer overflow in Zyxel ATP series firmware

Priority CRITICAL 100KEV

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.28144 Published 2023-05-24 No fix listed CWE-120
TI-2023-13281 CVE-2023-28771 · GHSA-3xvp-8qg2-x43w

OS command injection in Zyxel ZyWALL/USG series firmware

Priority CRITICAL 100KEV

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99284 Published 2023-04-25 No fix listed CWE-78
TI-2022-12682 CVE-2022-30525 · GHSA-987m-9prq-3p7m

OS command injection in Zyxel USG FLEX 100 firmware

Priority CRITICAL 100KEV

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99944 Published 2022-05-12 No fix listed CWE-78
TI-2020-07267 CVE-2020-9054 · GHSA-w6h5-rjp3-hxvc

OS command injection in Zyxel NAS326

Priority CRITICAL 100KEV

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary co…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99988 Published 2020-03-04 No fix listed CWE-78
TI-2022-00268 CVE-2022-0342 · GHSA-5g3j-g6gx-xfcg

Improper authentication in Zyxel USG/ZyWALL series firmware

Priority CRITICAL 86

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.2…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95134 Published 2022-03-28 No fix listed CWE-287
TI-2023-12581 CVE-2023-27991 · GHSA-2j4f-52m8-xq9h

OS command injection in Zyxel ATP series firmware

Priority MEDIUM 43

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01453 Published 2023-04-24 No fix listed CWE-78
TI-2022-09869 CVE-2022-26531 · GHSA-rg7w-p5vw-jmcc

Improper input validation in Zyxel USG/ZyWALL series firmware

Priority MEDIUM 43

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versi…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0637 Published 2022-05-24 No fix listed CWE-20
TI-2022-09870 CVE-2022-26532 · GHSA-gfh5-53xq-j227

OS command injection in Zyxel USG/ZyWALL series firmware

Priority MEDIUM 42

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.04789 Published 2022-05-24 No fix listed CWE-88
TI-2023-09055 CVE-2023-22917 · GHSA-34gf-pfjm-cq2w

Buffer overflow in Zyxel ATP series firmware

Priority MEDIUM 41

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00879 Published 2023-04-24 No fix listed CWE-120
TI-2022-18135 CVE-2022-38547 · GHSA-w85w-m9jr-jffx

OS command injection in Zyxel ZyWALL/USG series firmware

Priority LOW 39

A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02829 Published 2023-02-07 No fix listed CWE-78
TI-2022-00646 CVE-2022-0734 · GHSA-3mfr-f8f8-px3w

Cross-site scripting in Zyxel USG/ZyWALL series firmware

Priority LOW 39

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.3…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.09669 Published 2022-05-24 No fix listed CWE-79
TI-2023-09054 CVE-2023-22916 · GHSA-34w5-49cc-qp8r

Improper input validation in Zyxel ATP series firmware

Priority LOW 38

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00693 Published 2023-04-24 No fix listed CWE-20
TI-2023-05872 CVE-2023-6398 · GHSA-p6jh-65c7-8r26

OS command injection in Zyxel ATP series firmware

Priority LOW 36

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01333 Published 2024-02-20 Fixed in 6.29(ABYW.4), 6.70(ABVS.1) +2 CWE-78
TI-2022-12683 CVE-2022-30526 · GHSA-8f7x-36qv-2prx

Improper privilege management in Zyxel USG FLEX 100 firmware

Priority LOW 36

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 t…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01135 Published 2022-07-19 No fix listed CWE-269
TI-2023-09056 CVE-2023-22918 · GHSA-q9h2-893q-85gq

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP…

Priority LOW 32

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00771 Published 2023-04-24 No fix listed CWE-359
TI-2022-01882 CVE-2022-2030 · GHSA-cq2h-7r44-f9vg

Path traversal in Zyxel USG FLEX 100 firmware

Priority LOW 32

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01354 Published 2022-07-19 No fix listed CWE-22
TI-2023-05873 CVE-2023-6399 · GHSA-6mfv-h538-gwvr

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through…

Priority LOW 30

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 thro…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00649 Published 2024-02-20 No fix listed CWE-134
TI-2022-00814 CVE-2022-0910 · GHSA-mv2h-6cx9-44g2

Improper authentication in Zyxel USG/ZyWALL series firmware

Priority LOW 30

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0074 Published 2022-05-24 No fix listed CWE-287
TI-2023-05871 CVE-2023-6397 · GHSA-wj52-rfj4-xjcm

NULL pointer dereference in Zyxel ATP series firmware

Priority LOW 29

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause…

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.003 Published 2024-02-20 No fix listed CWE-476
TI-2022-19254 CVE-2022-40603 · GHSA-6jf5-53hp-585m

Cross-site scripting in Zyxel ZyWALL/USG series firmware

Priority LOW 27

A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00386 Published 2022-12-06 No fix listed CWE-79
TI-2023-12580 CVE-2023-27990 · GHSA-6qw9-cqm2-283v

Cross-site scripting in Zyxel ATP series firmware

Priority LOW 22

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00341 Published 2023-04-24 No fix listed CWE-79
Open these records in search →