Read the docs
TI-2022-09870 Aliases CVE-2022-26532GHSA-gfh5-53xq-j227

OS command injection in Zyxel USG/ZyWALL series firmware

Priority MEDIUM 42CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.

Why it matters now

EPSS 0.04789 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZyxelUSG/ZyWALL series firmware4.09 through 4.71—No fix listedCNA
ZyxelUSG FLEX series firmware4.50 through 5.21—No fix listedCNA
ZyxelATP series firmware4.32 through 5.21—No fix listedCNA
ZyxelVPN series firmware4.30 through 5.21—No fix listedCNA
ZyxelNSG series firmware1.00 through 1.33 Patch 4—No fix listedCNA
ZyxelNXC2500 firmwareup to 6.10(AAIG.3)—No fix listedCNA
ZyxelNAP203 firmwareup to 6.25(ABFA.7)—No fix listedCNA
ZyxelNWA50AX firmwareup to 6.25(ABYW.5)—No fix listedCNA
ZyxelWAC500 firmwareup to 6.30(ABVS.2)—No fix listedCNA
ZyxelWAX510D firmwareup to 6.30(ABTF.2)—No fix listedCNA
  • USG/ZyWALL series firmware VendorZyxel Affected 4.09 through 4.71 Fixed in — No fix listed CNA
  • USG FLEX series firmware VendorZyxel Affected 4.50 through 5.21 Fixed in — No fix listed CNA
  • ATP series firmware VendorZyxel Affected 4.32 through 5.21 Fixed in — No fix listed CNA
  • VPN series firmware VendorZyxel Affected 4.30 through 5.21 Fixed in — No fix listed CNA
  • NSG series firmware VendorZyxel Affected 1.00 through 1.33 Patch 4 Fixed in — No fix listed CNA
  • NXC2500 firmware VendorZyxel Affected up to 6.10(AAIG.3) Fixed in — No fix listed CNA
  • NAP203 firmware VendorZyxel Affected up to 6.25(ABFA.7) Fixed in — No fix listed CNA
  • NWA50AX firmware VendorZyxel Affected up to 6.25(ABYW.5) Fixed in — No fix listed CNA
  • WAC500 firmware VendorZyxel Affected up to 6.30(ABVS.2) Fixed in — No fix listed CNA
  • WAX510D firmware VendorZyxel Affected up to 6.30(ABTF.2) Fixed in — No fix listed CNA

CPE configurations NVD · 145

CPEVersionsRoleVendor
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*4.30 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*4.30 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*4.30 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*4.30 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* Versions 4.30 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:* Versions 4.30 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:* Versions 4.30 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:* Versions 4.30 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Show 135 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*4.32 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_110_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_110:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_1100_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_1100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_1900_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_1900:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_20w_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_20w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_310_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_310:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_40_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_40w_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_60_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_60w_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*4.50 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*4.50 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*4.50 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*4.50 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*4.50 – 5.21VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg200_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg20:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg2200_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg300_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*4.09 – 4.71VulnerableZyxel
cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nsg300_firmware:*:*:*:*:*:*:*:*1.00 to before 1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg300_firmware:1.33:-:*:*:*:*:*:*1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch1:*:*:*:*:*:*1.33 patch1VulnerableZyxel
cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch2:*:*:*:*:*:*1.33 patch2VulnerableZyxel
cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch3:*:*:*:*:*:*1.33 patch3VulnerableZyxel
cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch4:*:*:*:*:*:*1.33 patch4VulnerableZyxel
cpe:2.3:h:zyxel:nsg300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nsg100_firmware:*:*:*:*:*:*:*:*1.00 to before 1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg100_firmware:1.33:-:*:*:*:*:*:*1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch1:*:*:*:*:*:*1.33 patch1VulnerableZyxel
cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch2:*:*:*:*:*:*1.33 patch2VulnerableZyxel
cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch3:*:*:*:*:*:*1.33 patch3VulnerableZyxel
cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch4:*:*:*:*:*:*1.33 patch4VulnerableZyxel
cpe:2.3:h:zyxel:nsg100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nsg50_firmware:*:*:*:*:*:*:*:*1.00 to before 1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg50_firmware:1.33:-:*:*:*:*:*:*1.33VulnerableZyxel
cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch1:*:*:*:*:*:*1.33 patch1VulnerableZyxel
cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch2:*:*:*:*:*:*1.33 patch2VulnerableZyxel
cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch3:*:*:*:*:*:*1.33 patch3VulnerableZyxel
cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch4:*:*:*:*:*:*1.33 patch4VulnerableZyxel
cpe:2.3:h:zyxel:nsg50:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nxc2500_firmware:*:*:*:*:*:*:*:*up to 6.10\(aaig.3\)VulnerableZyxel
cpe:2.3:h:zyxel:nxc2500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nxc5500_firmware:*:*:*:*:*:*:*:*up to 6.10\(aaos.3\)VulnerableZyxel
cpe:2.3:h:zyxel:nxc5500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nap203_firmware:*:*:*:*:*:*:*:*up to 6.25\(abfa.7\)VulnerableZyxel
cpe:2.3:h:zyxel:nap203:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nap303_firmware:*:*:*:*:*:*:*:*up to 6.25\(abex.7\)VulnerableZyxel
cpe:2.3:h:zyxel:nap303:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nap353_firmware:*:*:*:*:*:*:*:*up to 6.25\(abey.7\)VulnerableZyxel
cpe:2.3:h:zyxel:nap353:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*up to 6.25\(abyw.5\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*up to 6.25\(abzl.5\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*up to 6.27\(accv.2\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*up to 6.30\(abtg.2\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*up to 6.30\(abtd.2\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa1123-ac-hd_firmware:*:*:*:*:*:*:*:*up to 6.25\(abin.6\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa1123-ac-hd:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa1123-ac-pro_firmware:*:*:*:*:*:*:*:*up to 6.25\(abhd.7\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa1123-ac-pro:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*up to 6.30\(abvt.2\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa1302-ac_firmware:*:*:*:*:*:*:*:*up to 6.25\(abku.6\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa1302-ac:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:nwa5123-ac-hd_firmware:*:*:*:*:*:*:*:*up to 6.25\(abim.6\)VulnerableZyxel
cpe:2.3:h:zyxel:nwa5123-ac-hd:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*up to 6.30\(abwa.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*up to 6.30\(abvs.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac5302d-s_firmware:*:*:*:*:*:*:*:*up to 6.10\(abfh.10\)VulnerableZyxel
cpe:2.3:h:zyxel:wac5302d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac5302d-sv2_firmware:*:*:*:*:*:*:*:*up to 6.25\(abvz.6\)VulnerableZyxel
cpe:2.3:h:zyxel:wac5302d-sv2:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6103d-i_firmware:*:*:*:*:*:*:*:*up to 6.25\(aaxh.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6103d-i:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6303d-s_firmware:*:*:*:*:*:*:*:*up to 6.25\(abgl.6\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6303d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6502d-e_firmware:*:*:*:*:*:*:*:*up to 6.25\(aasd.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6502d-e:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6502d-s_firmware:*:*:*:*:*:*:*:*up to 6.25\(aase.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6502d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6503d-s_firmware:*:*:*:*:*:*:*:*up to 6.25\(aasf.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6503d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6553d-s_firmware:*:*:*:*:*:*:*:*up to 6.25\(aasg.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6553d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wac6552d-s_firmware:*:*:*:*:*:*:*:*up to 6.25\(abio.7\)VulnerableZyxel
cpe:2.3:h:zyxel:wac6552d-s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*up to 6.30\(abtf.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*up to 6.30\(abte.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*up to 6.30\(abzd.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*up to 6.30\(abrm.2\)VulnerableZyxel
cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:* Versions 4.32 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_110_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_1100_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_1900_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_1900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_20w_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_20w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_20w-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_310_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_40_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_40w_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_40w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_60_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_60w_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_60w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* Versions 4.50 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* Versions 4.50 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* Versions 4.50 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* Versions 4.50 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* Versions 4.50 – 5.21 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg200_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg2200_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg300_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:* Versions 4.09 – 4.71 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:*:*:*:*:*:*:*:* Versions 1.00 to before 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:1.33:-:*:*:*:*:*:* Versions 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch1:*:*:*:*:*:* Versions 1.33 patch1 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch2:*:*:*:*:*:* Versions 1.33 patch2 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch3:*:*:*:*:*:* Versions 1.33 patch3 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg300_firmware:1.33:patch4:*:*:*:*:*:* Versions 1.33 patch4 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nsg300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:*:*:*:*:*:*:*:* Versions 1.00 to before 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:1.33:-:*:*:*:*:*:* Versions 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch1:*:*:*:*:*:* Versions 1.33 patch1 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch2:*:*:*:*:*:* Versions 1.33 patch2 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch3:*:*:*:*:*:* Versions 1.33 patch3 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg100_firmware:1.33:patch4:*:*:*:*:*:* Versions 1.33 patch4 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nsg100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:*:*:*:*:*:*:*:* Versions 1.00 to before 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:1.33:-:*:*:*:*:*:* Versions 1.33 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch1:*:*:*:*:*:* Versions 1.33 patch1 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch2:*:*:*:*:*:* Versions 1.33 patch2 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch3:*:*:*:*:*:* Versions 1.33 patch3 Vulnerable ·Zyxel
  • cpe:2.3:o:zyxel:nsg50_firmware:1.33:patch4:*:*:*:*:*:* Versions 1.33 patch4 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nsg50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nxc2500_firmware:*:*:*:*:*:*:*:* Versions up to 6.10\(aaig.3\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nxc2500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nxc5500_firmware:*:*:*:*:*:*:*:* Versions up to 6.10\(aaos.3\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nxc5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nap203_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abfa.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nap203:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nap303_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abex.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nap303:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nap353_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abey.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nap353:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abyw.5\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abzl.5\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:* Versions up to 6.27\(accv.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abtg.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abtd.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa1123-ac-hd_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abin.6\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa1123-ac-hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa1123-ac-pro_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abhd.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa1123-ac-pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abvt.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa1302-ac_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abku.6\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa1302-ac:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:nwa5123-ac-hd_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abim.6\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:nwa5123-ac-hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abwa.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abvs.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac5302d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.10\(abfh.10\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac5302d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac5302d-sv2_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abvz.6\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac5302d-sv2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6103d-i_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(aaxh.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6103d-i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6303d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abgl.6\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6303d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6502d-e_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(aasd.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6502d-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6502d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(aase.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6502d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6503d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(aasf.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6503d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6553d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(aasg.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6553d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wac6552d-s_firmware:*:*:*:*:*:*:*:* Versions up to 6.25\(abio.7\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wac6552d-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abtf.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abte.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abzd.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:* Versions up to 6.30\(abrm.2\) Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26532
  2. 2026-10-03 Alias added: GHSA-gfh5-53xq-j227

References

  • TI-2023-16198 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16197 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13281 OS command injection in Zyxel ZyWALL/USG series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-12682 OS command injection in Zyxel USG FLEX 100 firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-17772 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-07267 OS command injection in Zyxel NAS326 KEVCVSS 3.1CRITICAL 9.8
See all 23 →

Sources