Read the docs
TI-2021-13995 Aliases CVE-2021-35029GHSA-2h44-x2fr-537p

Improper authentication in Zyxel USG/Zywall series Firmware

Priority MEDIUM 46CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

Why it matters now

EPSS 0.02255 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZyxelUSG/Zywall series Firmware4.35 through 4.64—No fix listedCNA
ZyxelUSG FLEX series Firmware4.35 through 5.01—No fix listedCNA
ZyxelATP series Firmware4.35 through 5.01—No fix listedCNA
ZyxelVPN series Firmware4.35 through 5.01—No fix listedCNA
  • USG/Zywall series Firmware VendorZyxel Affected 4.35 through 4.64 Fixed in — No fix listed CNA
  • USG FLEX series Firmware VendorZyxel Affected 4.35 through 5.01 Fixed in — No fix listed CNA
  • ATP series Firmware VendorZyxel Affected 4.35 through 5.01 Fixed in — No fix listed CNA
  • VPN series Firmware VendorZyxel Affected 4.35 through 5.01 Fixed in — No fix listed CNA

CPE configurations NVD · 74

CPEVersionsRoleVendor
cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Show 64 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg300_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg1000_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg1000:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg2000_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg2000:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg20:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20w_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg20w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg50_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg50:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg100_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg200_firmware:*:*:*:*:*:*:*:*4.35 – 4.64VulnerableZyxel
cpe:2.3:h:zyxel:usg200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp100_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp100w_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp200_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp500_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp700_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_atp800_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_atp800:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_vpn50_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_vpn50:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_vpn100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_vpn300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*4.35 – 5.01VulnerableZyxel
cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg300_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg1000_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg2000_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg2000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20w_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg50_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg200_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 4.64 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp100w_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp200_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp500_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp700_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_atp800_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_atp800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_vpn50_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_vpn50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_vpn100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_vpn300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:* Versions 4.35 – 5.01 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35029
  2. 2026-10-03 Alias added: GHSA-2h44-x2fr-537p

References

Sources