Zyxel USG FLEX 50(W) / USG20(W)-VPN 4.16 < 5.43 / ATP 4.32 < 5.43 / USG FLEX 4.50 < 5.43 Path Traversal

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335410);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-14818");
  script_xref(name:"IAVA", value:"2026-A-0823");

  script_name(english:"Zyxel USG FLEX 50(W) / USG20(W)-VPN 4.16 < 5.43 / ATP 4.32 < 5.43 / USG FLEX 4.50 < 5.43 Path Traversal");

  script_set_attribute(attribute:"synopsis", value:
"The remote security gateway is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"The firmware version of the Zyxel ZLD firewall device is affected by a path traversal vulnerability. A path
traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware
versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1,
USG FLEX 50(W) series firmware versions from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware
versions from V4.16 through V5.42 Patch 1 could allow an authenticated attacker with administrator privileges
to execute a crafted malicious configuration file on an affected device.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?546bf402");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Zyxel ZLD firmware version V5.43 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14818");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:zyxel:usg_flex");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zyxel_usg_web_detect.nbin", "zyxel_usg_detect.nbin");
  script_require_keys("installed_sw/Zyxel Unified Security Gateway (USG)");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Zyxel Unified Security Gateway (USG)', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'requires': [{'scope': 'install', 'contains': {'Model': 'ATP'}}],
          'min_version': '4.32', 'fixed_version': '5.43'
        },
        {
          'requires': [{'scope': 'install', 'regex_match': {'Model': "(USG ?FLEX ?50W?|USG ?20W?-VPN)($|[^0-9])"}}],
          'min_version': '4.16', 'fixed_version': '5.43'
        },
        {
          'requires': [
            {'scope': 'install', 'contains': {'Model': 'USG FLEX'}},
            {'scope': 'install', 'not_regex_match': {'Model': "USG ?FLEX ?50W?($|[^0-9])"}}
          ],
          'min_version': '4.50', 'fixed_version': '5.43'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);