Read the docs

Zyxel

Records341All Threatist records
Exploited (KEV)13In CISA KEV
CVSS critical64CVSS 9.0–10.0
CVSS high136CVSS 7.0–8.9

Exploited now

Zyxel records in CISA KEV
TI-2026-06387 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Priority CRITICAL 97KEV 2026-09-21TI-2024-27255 Zyxel DSL CPE OS Command Injection Vulnerability Priority CRITICAL 97KEV 2025-02-11TI-2024-27256 Zyxel DSL CPE OS Command Injection Vulnerability Priority CRITICAL 97KEV 2025-02-11TI-2024-10813 Zyxel Multiple Firewalls Path Traversal Vulnerability Priority CRITICAL 99KEV 2024-12-03TI-2017-04616 Zyxel EMG2926 Routers Command Injection Vulnerability Priority CRITICAL 97KEV 2023-09-18TI-2017-13541 Zyxel P660HN-T1A Routers Command Injection Vulnerability Priority CRITICAL 100KEV 2023-08-07

Components

Products in the NVD configurations · select one to filter the records
Cloudcnm Secumanager 35 records MEDIUM Gs1900-10hp Firmware 35 records CRITICAL Usg Flex 100w Firmware 34 records CRITICAL Usg Flex 200 Firmware 34 records CRITICAL Usg Flex 500 Firmware 34 records CRITICAL Usg Flex 700 Firmware 34 records CRITICAL Usg Flex 100 Firmware 30 records CRITICAL Emg3525-t50b Firmware 28 records MEDIUM

Records

19 records in Usg 20w-vpn Firmware · all components

TI-2023-16198 CVE-2023-33010 · GHSA-fqv9-84fh-jjgr

Buffer overflow in Zyxel ATP series firmware

Priority CRITICAL 100KEV

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29024 Published 2023-05-24 No fix listed CWE-120
TI-2023-16197 CVE-2023-33009 · GHSA-g3f9-6h7x-x69v

Buffer overflow in Zyxel ATP series firmware

Priority CRITICAL 100KEV

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.28144 Published 2023-05-24 No fix listed CWE-120
TI-2023-16200 CVE-2023-33012 · GHSA-r34v-7h65-289c

OS command injection in Zyxel ATP series firmware

Priority MEDIUM 52

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmwa…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.09882 Published 2023-07-17 No fix listed CWE-78
TI-2023-12581 CVE-2023-27991 · GHSA-2j4f-52m8-xq9h

OS command injection in Zyxel ATP series firmware

Priority MEDIUM 43

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01453 Published 2023-04-24 No fix listed CWE-78
TI-2022-09869 CVE-2022-26531 · GHSA-rg7w-p5vw-jmcc

Improper input validation in Zyxel USG/ZyWALL series firmware

Priority MEDIUM 43

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versi…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0637 Published 2022-05-24 No fix listed CWE-20
TI-2022-09870 CVE-2022-26532 · GHSA-gfh5-53xq-j227

OS command injection in Zyxel USG/ZyWALL series firmware

Priority MEDIUM 42

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.04789 Published 2022-05-24 No fix listed CWE-88
TI-2023-09055 CVE-2023-22917 · GHSA-34gf-pfjm-cq2w

Buffer overflow in Zyxel ATP series firmware

Priority MEDIUM 41

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00879 Published 2023-04-24 No fix listed CWE-120
TI-2023-09053 CVE-2023-22915 · GHSA-qm4q-mvq2-gj2r

Buffer overflow in Zyxel USG FLEX series firmware

Priority MEDIUM 41

A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.3…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01054 Published 2023-04-24 No fix listed CWE-120
TI-2023-16199 CVE-2023-33011 · GHSA-cf8h-9592-vmxr

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36…

Priority MEDIUM 40

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Pa…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.0034 Published 2023-07-17 No fix listed CWE-134
TI-2023-13277 CVE-2023-28767 · GHSA-6hq2-q59r-h45h

OS command injection in Zyxel ATP series firmware

Priority MEDIUM 40

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00404 Published 2023-07-17 No fix listed CWE-78
TI-2022-00646 CVE-2022-0734 · GHSA-3mfr-f8f8-px3w

Cross-site scripting in Zyxel USG/ZyWALL series firmware

Priority LOW 39

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.3…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.09669 Published 2022-05-24 No fix listed CWE-79
TI-2023-16985 CVE-2023-34141 · GHSA-2hgc-m6qj-p4p4

OS command injection in Zyxel ATP series firmware

Priority LOW 38

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(…

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.00684 Published 2023-07-17 No fix listed CWE-78
TI-2023-16982 CVE-2023-34138 · GHSA-886j-wm8v-5q3q

OS command injection in Zyxel ATP series firmware

Priority LOW 38

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series…

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.00684 Published 2023-07-17 No fix listed CWE-78
TI-2023-09054 CVE-2023-22916 · GHSA-34w5-49cc-qp8r

Improper input validation in Zyxel ATP series firmware

Priority LOW 38

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00693 Published 2023-04-24 No fix listed CWE-20
TI-2023-09056 CVE-2023-22918 · GHSA-q9h2-893q-85gq

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP…

Priority LOW 32

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00771 Published 2023-04-24 No fix listed CWE-359
TI-2022-00814 CVE-2022-0910 · GHSA-mv2h-6cx9-44g2

Improper authentication in Zyxel USG/ZyWALL series firmware

Priority LOW 30

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0074 Published 2022-05-24 No fix listed CWE-287
TI-2023-16984 CVE-2023-34140 · GHSA-65px-649g-rj37

Buffer overflow in Zyxel ATP series firmware

Priority LOW 29

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36…

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.003 Published 2023-07-17 No fix listed CWE-120
TI-2023-12580 CVE-2023-27990 · GHSA-6qw9-cqm2-283v

Cross-site scripting in Zyxel ATP series firmware

Priority LOW 22

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00341 Published 2023-04-24 No fix listed CWE-79
Open these records in search →