Command injection

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

Cross site scripting

The cross-site scripting XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through...

CVE-2023-22916

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...

Buffer overflow

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-22918

CVE-2023-22918 describes a post-authentication information exposure in Zyxel devices' CGI program that could allow a remote authenticated attacker to retrieve encrypted administrator information. Affected are Zyxel products: ATP series (firmware 4.32–5.35); USG FLEX series (4.50–5.35); USG FLEX 5...

Zyxel ATP 跨站脚本漏洞

Zyxel ATP is a firewall from China Heqin Zyxel. A cross-site scripting vulnerability exists in multiple Zyxel products. The vulnerability is exploited by attackers to conduct cross-site scripting attacks. The following products and versions are affected: Zyxel ATP version 4.32 through 5.35, USG...

CVE-2023-27991

Zyxel vulnerability CVE-2023-27991 is a post-authentication command injection in the CLI of Zyxel firewall devices (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, ZyWALL/USG) that could let an authenticated attacker execute OS commands remotely. Affected firmware ranges include ATP 4.32–5.35, ...

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

PT-2023-8181 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 5.10 through 5.35 Zyxel USG FLEX series versions 5.00 through 5.35 Zyxel USG FLEX 50W versions 5.10 through 5.35 Zyxel USG20W-VPN versions 5.10 through 5.35 Zyxel VPN series versions 5.00 through 5.35 Description: Th...

CVE-2023-22917

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-22917

CVE-2023-22917 is a buffer overflow in Zyxel sdwan_iface_ipc used by Zyxel ATP/USG/FLEX/VPN firmware. The flaw allows a remote unauthenticated attacker to cause a core dump via a crafted configuration file upload, affecting Zyxel products (ATP 5.10–5.32; USG FLEX 5.00–5.32; USG FLEX 50(W) 5.10–5....

PT-2023-7790 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

Zyxel ATP 安全漏洞

Zyxel ATP is a firewall from China's Heqin Zyxel. A security vulnerability exists in Zyxel ATP versions 5.10 through 5.35, which can be exploited by an attacker to retrieve encrypted information from administrators on affected devices...

CVE-2023-27990: Improper Neutralization of Input During Web Page Generation

The cross-site scripting XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through...

CVE-2023-22918: Exposure of Private Personal Information to an Unauthorized Actor

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, VPN series...

CVE-2023-27991: Improper Neutralization of Special Elements used in an OS Command

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-22916: Improper Input Validation

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...

CVE-2023-22917: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-22916

CVE-2023-22916 affects Zyxel devices including ATP series (5.10–5.35), USG FLEX series (5.00–5.35), USG FLEX 50(W) (5.10–5.35), USG20(W)-VPN (5.10–5.35), and VPN series (5.00–5.35). Root cause: improper sanitization in the configuration parser. Impact: remote unauthenticated attackers could modif...