CVE-2022-2324

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions...

CVE-2022-2324

SonicWall Hosted Email Security (HES) is affected. Versions prior to 10.0.17.7319 contain an improperly implemented security check in the Capture ATP feature, enabling bypass of the Capture ATP security service. The issue could be exploited by an unauthenticated attacker to bypass security contro...

PT-2022-15915

Name of the Vulnerable Software and Affected Versions SonicWall Hosted Email Security versions prior to 10.0.17.7319 Description The issue is related to an improperly implemented security check in the SonicWall Hosted Email Security, which allows for the bypass of the Capture ATP security service...

CVE-2022-2324: Improperly Implemented Security Check for Standard

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions...

PT-2022-3781 · Zyxel · Zyxel Usg/Zywall Series +8

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX 100W versions 4.50 through 5.30 Zyxel USG FLEX 200 versions 4.50 through 5.30 Zyxel USG FLEX 500 versions 4.50 through 5.30 Zyxel USG FLEX 700 versions 4.50 through 5.30 Zyxel USG FLEX 50W versions 4.16 through 5.30 Zyxel...

CVE-2022-30526: Improper Privilege Management

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

CVE-2022-2030: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...

SonicWALL Hosted Email Security 安全特征问题漏洞

SonicWALL Hosted Email Security is an advanced cloud email security service from SonicWALL, Inc. A security feature issue vulnerability exists in SonicWall Hosted Email Security HES version 10.0.17.7319 and prior versions that stems from the incorrect implementation of certain security features i...

SonicWall Hosted Email Security Capture ATP Bypass

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. CVE: CVE-2022-2324 Last updated: July 14, 2022, 6:43 p.m...

CGI Interface Security Bypass

The vulnerability of the Common Gateway Interface CGI interface of ZyXEL USG, ZyWALL, USG FLEX, ATP, and VPN network devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by using IPSec VPN...

Zyxel Firewall SUID Binary Privilege Escalation

This module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 Zyxel Firewall Remote Command Injection A py...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability...

CVE-2022-26532

CVE-2022-26532 is a local command-injection vulnerability in Zyxel devices’ packet-trace CLI, affecting USG/ZyWALL family firmwares 4.09–4.71, USG FLEX 4.50–5.21, ATP 4.32–5.21, VPN 4.30–5.21, NSG 1.00–1.33 Patch 4, NXC2500 6.10 AAIG.3 and earlier, NAP203 6.25 ABFA.7 and earlier, NWA50AX 6.25 ABY...

CVE-2022-0910

CVE-2022-0910 describes an authentication-bypass flaw in Zyxel firewall products where an authenticated attacker can downgrade from two-factor to one-factor authentication when connecting to the IPsec VPN server. Affected are Zyxel USG/ZyWALL firmware 4.32–4.71, USG FLEX 4.50–5.21, ATP 4.32–5.21,...

CVE-2022-0734

CVE-2022-0734 describes a cross-site scripting vulnerability in Zyxel USG/ZyWALL CGI programs across multiple firmware lines (USG/ZyWALL 4.35–4.70, USG FLEX 4.50–5.20, ATP 4.35–5.20, VPN 4.35–5.20). The issue allows a malicious script to access information stored in a user’s browser, such as cook...

PT-2022-3646

Name of the Vulnerable Software and Affected Versions Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71 Zyxel USG FLEX series firmware versions 4.50 through 5.21 Zyxel ATP series firmware versions 4.32 through 5.21 Zyxel VPN series firmware versions 4.30 through 5.21 Zyxel NSG series...

CVE-2022-0910: Improper Authentication

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware...

CVE-2022-26531: Improper Input Validation

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...

PT-2022-3363

Name of the Vulnerable Software and Affected Versions ZyXEL USG/ZyWALL series firmware versions 4.32 through 4.71 ZyXEL USG FLEX series firmware versions 4.50 through 5.21 ZyXEL ATP series firmware versions 4.32 through 5.21 ZyXEL VPN series firmware versions 4.32 through 5.21 Description The...