PT-2023-7790 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

CVE-2023-22915

A buffer overflow vulnerability in the “fbwififorward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.30 through 5.35, USG20W-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could...

CVE-2023-22915

CVE-2023-22915 affects Zyxel USG FLEX family (USG FLEX 4.50–5.35; USG FLEX 50(W) 4.30–5.35; USG20(W)-VPN 4.30–5.35; VPN series 4.30–5.35). Root cause: buffer overflow in fbwifi_forward.cgi when Facebook WiFi is enabled. Impact: remote unauthenticated attacker can cause Denial-of-Service by sendin...

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-22914

A path traversal vulnerability in the “accountprint.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS command...

CVE-2023-22913

A post-authentication command injection vulnerability in the “accountoperator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data,...

CVE-2023-22917

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

Zyxel ATP 跨站脚本漏洞

Zyxel ATP is a firewall from China Heqin Zyxel. A cross-site scripting vulnerability exists in multiple Zyxel products. The vulnerability is exploited by attackers to conduct cross-site scripting attacks. The following products and versions are affected: Zyxel ATP version 4.32 through 5.35, USG...

CVE-2023-22918

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, VPN series...

CVE-2023-22916

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...

PT-2023-8181 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 5.10 through 5.35 Zyxel USG FLEX series versions 5.00 through 5.35 Zyxel USG FLEX 50W versions 5.10 through 5.35 Zyxel USG20W-VPN versions 5.10 through 5.35 Zyxel VPN series versions 5.00 through 5.35 Description: Th...

CVE-2023-27990

The CVE-2023-27990 XSS vulnerability affects Zyxel devices (ATP, USG FLEX series, USG FLEX 50(W), USG20(W)-VPN, VPN series) with versions ranging from 4.x to 5.x. An authenticated administrator could store malicious scripts that execute when visiting the device GUI Logs page. Affected components ...

Zyxel USG FLEX 命令注入漏洞

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in the Zyxel USG FLEX Series 4.50 to 5.35 firmware versions, and the VPN Series 4....

CVE-2023-27991

Zyxel vulnerability CVE-2023-27991 is a post-authentication command injection in the CLI of Zyxel firewall devices (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, ZyWALL/USG) that could let an authenticated attacker execute OS commands remotely. Affected firmware ranges include ATP 4.32–5.35, ...

CVE-2023-22917

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-22918

CVE-2023-22918 describes a post-authentication information exposure in Zyxel devices' CGI program that could allow a remote authenticated attacker to retrieve encrypted administrator information. Affected are Zyxel products: ATP series (firmware 4.32–5.35); USG FLEX series (4.50–5.35); USG FLEX 5...

CVE-2023-22913

CVE-2023-22913 describes a post-authentication command injection in Zyxel’s account_operator.cgi used by USG FLEX and VPN firmware: USG FLEX 4.50–5.35 and VPN 4.30–5.35. An authenticated attacker could inject commands to modify device configuration data, leading to DoS. The technical details in t...

CVE-2023-22916

CVE-2023-22916 affects Zyxel devices including ATP series (5.10–5.35), USG FLEX series (5.00–5.35), USG FLEX 50(W) (5.10–5.35), USG20(W)-VPN (5.10–5.35), and VPN series (5.00–5.35). Root cause: improper sanitization in the configuration parser. Impact: remote unauthenticated attackers could modif...

PT-2023-7789 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

CVE-2023-22917

CVE-2023-22917 is a buffer overflow in Zyxel sdwan_iface_ipc used by Zyxel ATP/USG/FLEX/VPN firmware. The flaw allows a remote unauthenticated attacker to cause a core dump via a crafted configuration file upload, affecting Zyxel products (ATP 5.10–5.32; USG FLEX 5.00–5.32; USG FLEX 50(W) 5.10–5....