OS command injection in Zyxel ATP series firmware
Priority LOW 36CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01333 71st percentileScored 2026-11-08
Fix Fixed NWA50AX firmware (Zyxel): 6.29(ABYW.4)WAC500 firmware (Zyxel): 6.70(ABVS.1)+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zyxel | ATP series firmware | version 4.32 through 5.37 Patch 1 | — | No fix listed | CNA |
| Zyxel | USG FLEX series firmware | version 4.50 through 5.37 Patch 1 | — | No fix listed | CNA |
| Zyxel | USG FLEX 50(W) series firmware | version 4.16 through 5.37 Patch 1 | — | No fix listed | CNA |
| Zyxel | USG20(W)-VPN series firmware | version 4.16 through 5.37 Patch 1 | — | No fix listed | CNA |
| Zyxel | NWA50AX firmware | before 6.29(ABYW.4) | 6.29(ABYW.4) | Patch available | CNA |
| Zyxel | WAC500 firmware | before 6.70(ABVS.1) | 6.70(ABVS.1) | Patch available | CNA |
| Zyxel | WAX300H firmware | before 6.70(ACHF.1) | 6.70(ACHF.1) | Patch available | CNA |
| Zyxel | WBE660S firmware | before 6.70(ACGG.1) | 6.70(ACGG.1) | Patch available | CNA |
| Zyxel | USG FLEX H series firmware | version 1.10 through 1.10 Patch 1 | — | No fix listed | CNA |
- ATP series firmware VendorZyxel Affected version 4.32 through 5.37 Patch 1 Fixed in — No fix listed CNA
- USG FLEX series firmware VendorZyxel Affected version 4.50 through 5.37 Patch 1 Fixed in — No fix listed CNA
- USG FLEX 50(W) series firmware VendorZyxel Affected version 4.16 through 5.37 Patch 1 Fixed in — No fix listed CNA
- USG20(W)-VPN series firmware VendorZyxel Affected version 4.16 through 5.37 Patch 1 Fixed in — No fix listed CNA
- NWA50AX firmware VendorZyxel Affected before 6.29(ABYW.4) Fixed in 6.29(ABYW.4) Patch available CNA
- WAC500 firmware VendorZyxel Affected before 6.70(ABVS.1) Fixed in 6.70(ABVS.1) Patch available CNA
- WAX300H firmware VendorZyxel Affected before 6.70(ACHF.1) Fixed in 6.70(ACHF.1) Patch available CNA
- WBE660S firmware VendorZyxel Affected before 6.70(ACGG.1) Fixed in 6.70(ACGG.1) Patch available CNA
- USG FLEX H series firmware VendorZyxel Affected version 1.10 through 1.10 Patch 1 Fixed in — No fix listed CNA
CPE configurations NVD · 127
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
- cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
Show 117 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:* | 4.32 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* | 4.16 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* | 4.16 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:* | 4.50 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:* | 4.16 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:* | 4.16 to before 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:* | 5.37 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:* | 5.37 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:* | 1.10 | Vulnerable | Zyxel |
| cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:* | 1.10 patch1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:* | before 6.29\(abyw.4\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:* | before 6.29\(abzl.4\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:* | before 6.29\(accv.4\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:* | before 6.70\(abtg.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:* | before 6.70\(abtd.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:* | before 6.70\(acco.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:* | before 6.70\(abvt.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:* | before 6.70\(abvs.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:* | before 6.70\(abwa.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:* | before 6.70\(achf.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax300h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:* | before 6.70\(abtf.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:* | before 6.70\(abte.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:* | before 6.70\(accn.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:* | before 6.70\(abzd.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:* | before 6.70\(accm.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:* | before 6.70\(abrm.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:* | before 6.70\(acdo.1\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:* | before 6.70\(acgg.2\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:* | before 6.80\(acge.0\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa50ax-pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:* | before 6.80\(acgf.0\) | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:nwa90ax-pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
- cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:* Versions 4.32 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:* Versions 4.16 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* Versions 4.16 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:* Versions 4.50 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.16 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:* Versions 4.16 to before 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:* Versions 5.37 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:* Versions 5.37 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:* Versions 1.10 Vulnerable ·Zyxel
- cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:* Versions 1.10 patch1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:* Versions before 6.29\(abyw.4\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:* Versions before 6.29\(abzl.4\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:* Versions before 6.29\(accv.4\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abtg.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abtd.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(acco.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abvt.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abvs.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abwa.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(achf.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax300h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abtf.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abte.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(accn.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abzd.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(accm.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(abrm.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(acdo.1\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:* Versions before 6.70\(acgg.2\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:* Versions before 6.80\(acge.0\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa50ax-pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:* Versions before 6.80\(acgf.0\) Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:nwa90ax-pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Remediation
- Fix · CNA NWA50AX firmware (Zyxel) Fixed in 6.29(ABYW.4)
- Fix · CNA WAC500 firmware (Zyxel) Fixed in 6.70(ABVS.1)
- Fix · CNA WAX300H firmware (Zyxel) Fixed in 6.70(ACHF.1)
- Fix · CNA WBE660S firmware (Zyxel) Fixed in 6.70(ACGG.1)
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Zyxel ATP series firmware, USG FLEX 50(W) series firmware and 3 more products — zyxel.com/global/en/support/security-advisories/zyxel-secur…
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2023-06180 A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series…Priority LOW 39
- TI-2023-05873 A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through…Priority LOW 30
- TI-2023-05871 NULL pointer dereference in Zyxel ATP series firmwarePriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6398
- 2026-10-03 Alias added: GHSA-p6jh-65c7-8r26
References
More Zyxel Atp100 Firmware vulnerabilities
- TI-2023-16198 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16197 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
- TI-2023-13281 OS command injection in Zyxel ZyWALL/USG series firmware KEVCVSS 3.1CRITICAL 9.8
- TI-2022-12682 OS command injection in Zyxel USG FLEX 100 firmware KEVCVSS 3.1CRITICAL 9.8
- TI-2020-17772 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-07267 OS command injection in Zyxel NAS326 KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6398 · CVE Program
- CVE-2023-6398 · NVD
- FIRST EPSS
- GHSA-p6jh-65c7-8r26 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences