Cross site scripting

A cross-site scripting XSS vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50W series firmware versions 5.10 through 5.37, USG20W-VPN series firmware versions 5.10 through 5.37, and VPN...

Buffer overflow

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30...

Integer overflow

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series...

Privilege escalation

An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and VPN seri...

CVE-2023-5797

CVE-2023-5797 describes an improper privilege management vulnerability in the debug CLI command of Zyxel devices. Affected products include Zyxel ATP series (4.32–5.37), USG FLEX series (4.50–5.37), USG FLEX 50(W) (4.16–5.37), USG20(W)-VPN (4.16–5.37), VPN series (4.30–5.37), NWA50AX (6.29 ABYW.2...

CVE-2023-5797

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-5797

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-5650

An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and VPN seri...

CVE-2023-5650

CVE-2023-5650 describes an improper privilege management vulnerability in Zyxel ZySH that affects Zyxel ATP, USG FLEX (including 50(W)), USG20(W)-VPN, and VPN series firmware. A authenticated local attacker could exploit ZySH to modify the URL of the registration page in the device web GUI, enabl...

CVE-2023-4398

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series...

CVE-2023-4398

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series...

CVE-2023-4397

A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50W series firmware version 5.37, and USG20W-VPN series firmware version 5.37, could allow an authenticated local attacker with administrator privileges to cause...

CVE-2023-4397

The CVE-2023-4397 issue is a buffer overflow in Zyxel ATP/USG firmware (5.37 primarily) that can be triggered by an authenticated local attacker with administrator privileges via crafted CLI strings, leading to DoS. Affected: Zyxel ATP series, USG FLEX series, USG FLEX 50(W), USG20(W)-VPN; root c...

CVE-2023-37926

The CVE-2023-37926 issue affects Zyxel devices including ATP series 4.32–5.37, USG FLEX series 4.50–5.37, USG FLEX 50(W) 4.16–5.37, USG20(W)-VPN 4.16–5.37, and VPN series 4.30–5.37. It is a buffer overflow in firmware that enables an authenticated local attacker to cause denial-of-service by runn...

CVE-2023-37925

CVE-2023-37925 describes an improper privilege management vulnerability in the debug CLI command on Zyxel devices (ATP series 4.32–5.37; USG FLEX series 4.50–5.37; USG FLEX 50(W) 4.16–5.37; USG20(W)-VPN 4.16–5.37; VPN 4.30–5.37; NWA50AX 6.29(ABYW.2); WAC500 6.65(ABVS.1); WAX300H 6.60(ACHF.1); WBE...

CVE-2023-37925

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-35139

Summary of CVE-2023-35139 : A cross-site scripting (XSS) vulnerability exists in the CGI program of Zyxel ATP series (5.10–5.37), USG FLEX series (5.00–5.37), USG FLEX 50(W) (5.10–5.37), USG20(W)-VPN (5.10–5.37), and VPN series (5.00–5.37). An unauthenticated LAN-based attacker could store malici...

CVE-2023-35139

A cross-site scripting XSS vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50W series firmware versions 5.10 through 5.37, USG20W-VPN series firmware versions 5.10 through 5.37, and VPN...

CVE-2023-35136

An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and...

CVE-2023-35136

CVE-2023-35136 describes an improper input validation vulnerability in the Quagga package across Zyxel devices (ATP series 4.32–5.37; USG FLEX 4.50–5.37; USG FLEX 50(W) 4.16–5.37; USG20(W)-VPN 4.16–5.37; VPN series 4.30–5.37) that could allow an authenticated local attacker to access configuratio...