CVE-2023-33012: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10...

CVE-2023-34140: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50W series firmware versions 4.16 through 5.36 Patch 2, USG20W-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN...

CVE-2023-33011: Use of Externally-Controlled Format String

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

Malicious code in blossom-flex-ui-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45835a19933049983c803d03cb5c9fe34157fa2a4d00823f43d60983bbc79966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-136 Malicious code in blossom-flex-ui-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45835a19933049983c803d03cb5c9fe34157fa2a4d00823f43d60983bbc79966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the account_operator.cgi file in the microprogramming software for ZyXEL USG FLEX and VPN devices allows a hacker to alter the device’s configuration data and trigger a service failure.

The vulnerability of the accountoperator.cgi file in the ZyXEL USG FLEX and VPN networking devices relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow a malicious actor to remotely alter the device’s...

Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution Exploit

This Metasploit module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange IKE packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are as follows: ATP Firmware version 4.60 to 5.35 inclusive, USG FLEX...

flex:fuzz-main: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4878367963611136 Project: flex Fuzzing Engine: libFuzzer Fuzz Target: fuzz-main Job Type: libfuzzerubsanflex Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000b926417 Crash State: NULL Sanitizer: undefined UBSAN Recommended Securi...

flex:fuzz-main: Heap-buffer-overflow in sf_init

Detailed Report: https://oss-fuzz.com/testcase?key=5603512147640320 Project: flex Fuzzing Engine: afl Fuzz Target: fuzz-main Job Type: aflasanflex Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x60c000011d10 Crash State: sfinit flexinit flexmain Sanitizer: address ASA...

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

Zyxel ATP, USG FLEX, USG FLEX 50W, USG20W-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service DoS conditions and remote code execution on an affected device...

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device...

PT-2023-22605

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 17.0.1 Zyxel ATP Series, USG FLEX Series, USG FLEX 50W Series, and USG20W-VPN Series affected versions not specified Description The issue allows remote code execution by an authenticated user via an uppercase...

Zyxel patches two critical vulnerabilities

Zyxell has released a security advisory for multiple buffer overflow vulnerabilities. Exploitation of these vulnerabilities could allow an unauthenticated attacker to cause denial-of-service DoS conditions and even a remote code execution on the affected Zyxell firewalls. Affected users should...

The vulnerability of the microprogrammed software of Zyxel ATP network devices, such as USG FLEX, USG FLEX50(W), USG20(W)-VPN, VPN, ZyWALL/USG, arises from copying buffers without checking the size of the input data. This allows a malicious actor to execute arbitrary code or cause service failures.

The vulnerability of microprogrammed network devices such as Zyxel ATP, USG FLEX, USG FLEX50W, USG20W-VPN, VPN, ZyWALL/USG lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service...

Vulnerabilities fixed in Zyxel firewalls

Zyxel has fixed vulnerabilities in the firmware of firewall series ATP, USG FLEX, VPN and ZyWall/USG. An unauthenticated malicious party could exploit the vulnerabilities to cause a denial-of-service, and possibly also to execute arbitrary execute arbitrary code on the vulnerable system. Zyxel ha...

CVE-2023-33009

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50W firmware versions 4.60 through 5.36 Patch 1, USG20W-VPN firmware versions 4.60 through 5.36 Patch...

CVE-2023-33010

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50W firmware versions 4.25 through 5.36 Patch 1, USG20W-VPN firmware versions 4.25 through 5.36 Patc...

CVE-2023-33009

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50W firmware versions 4.60 through 5.36 Patch 1, USG20W-VPN firmware versions 4.60 through 5.36 Patch...

Buffer overflow

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50W firmware versions 4.60 through 5.36 Patch 1, USG20W-VPN firmware versions 4.60 through 5.36 Patch...

Buffer overflow

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50W firmware versions 4.25 through 5.36 Patch 1, USG20W-VPN firmware versions 4.25 through 5.36 Patc...