A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of…
Priority MEDIUM 49CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.
Why it matters now
EPSS 0.0444 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:* | 4.30 – 4.55 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_1100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_1900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_20w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
- cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:* Versions 4.30 – 4.55 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_1900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_20w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:zyxel:usg_310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:*:*:*:*:*:*:*:* | up to 6.10 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:-:*:*:*:*:*:* | 6.10 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch1:*:*:*:*:*:* | 6.10 patch1 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch2:*:*:*:*:*:* | 6.10 patch2 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch3:*:*:*:*:*:* | 6.10 patch3 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch4:*:*:*:*:*:* | 6.10 patch4 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch5:*:*:*:*:*:* | 6.10 patch5 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch6:*:*:*:*:*:* | 6.10 patch6 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:6.10:patch7:*:*:*:*:*:* | 6.10 patch7 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa1123-ac_hd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa1123-ac_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:access_points_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa1123-acv2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wac5302d-s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa5120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa5301-nj:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wac6550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wac6303d-s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wac6500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:wac6100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:h:zyxel:nwa1302-ac:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
- cpe:2.3:h:zyxel:usg_310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:*:*:*:*:*:*:*:* Versions up to 6.10 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:-:*:*:*:*:*:* Versions 6.10 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch1:*:*:*:*:*:* Versions 6.10 patch1 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch2:*:*:*:*:*:* Versions 6.10 patch2 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch3:*:*:*:*:*:* Versions 6.10 patch3 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch4:*:*:*:*:*:* Versions 6.10 patch4 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch5:*:*:*:*:*:* Versions 6.10 patch5 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch6:*:*:*:*:*:* Versions 6.10 patch6 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:6.10:patch7:*:*:*:*:*:* Versions 6.10 patch7 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa1123-ac_hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa1123-ac_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:access_points_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa1123-acv2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wac5302d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa5120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa5301-nj:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wac6550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wac6303d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wac6500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:wac6100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:h:zyxel:nwa1302-ac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25014
- 2026-10-03 Alias added: GHSA-f57w-r4hj-rw7w
References
Sources
- CVE-2020-25014 · CVE Program
- CVE-2020-25014 · NVD
- FIRST EPSS
- GHSA-f57w-r4hj-rw7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences