52 matches found
CVE-2023-33477
In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path...
MAL-2022-4961 Malicious code in nsg-setclient (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a49391790ed9fdf1fcef55b01ba364cb96663461031dd8361ba72da8c953f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nsg-setclient (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a49391790ed9fdf1fcef55b01ba364cb96663461031dd8361ba72da8c953f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nsg-epa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e52d20bda01ebb5ece5ef0740a627d3ab20c955ca610f952a1f9d3a8a4d96242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-26532
CVE-2022-26532 is a local command-injection vulnerability in Zyxel devices’ packet-trace CLI, affecting USG/ZyWALL family firmwares 4.09–4.71, USG FLEX 4.50–5.21, ATP 4.32–5.21, VPN 4.30–5.21, NSG 1.00–1.33 Patch 4, NXC2500 6.10 AAIG.3 and earlier, NAP203 6.25 ABFA.7 and earlier, NWA50AX 6.25 ABY...
PT-2022-3646
Name of the Vulnerable Software and Affected Versions Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71 Zyxel USG FLEX series firmware versions 4.50 through 5.21 Zyxel ATP series firmware versions 4.32 through 5.21 Zyxel VPN series firmware versions 4.30 through 5.21 Zyxel NSG series...
CVE-2022-26531
CVE-2022-26531 stems from multiple improper input validation flaws in Zyxel devices (USG/ZyWALL, USG FLEX, ATP, VPN, NSG, NXC2500, NAP203, NWA50AX, WAC500, WAX510D) across firmware ranges up to 4.71/5.21/6.x, enabling a local authenticated attacker to trigger a buffer overflow or system crash via...
CVE-2022-26531: Improper Input Validation
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...
CVE-2022-0342
CVE-2022-0342 describes an authentication bypass in Zyxel CGI web interfaces across multiple product lines (USG/ZyWALL, USG FLEX, ATP, VPN, NSG) with firmware ranges 4.20–4.70, 4.50–5.20, 4.32–5.20, 4.30–5.20, and 1.20–1.33 Patch 4. The flaw allows bypassing web authentication to obtain administr...
Weak password vulnerability in Netoray NSG Internet behavior management system (CNVD-2021-36245)
Lexus Technologies Beijing Co., Ltd. specializes in Layer 47 based application and protocol analysis and related product development, providing Internet behavior management, APT detection, and next-generation firewall products. A weak password vulnerability exists in the Netoray NSG Internet...
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
Command injection
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
CVE-2020-29299
CVE-2020-29299 affects Zyxel SD-OS/On-Premise lines (VPN On-Premise, VPN Orchestrator, USG, USG FLEX, ATP, NSG). A command injection occurs via an admin-provided input string to chg_exp_pwd during a password-change action. Root cause stated in multiple sources: lack of input validation/cleanup in...
CVE-2020-29299: Improper Neutralization of Special Elements used in a Command
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
Harmonic NSG 9000 Devices Remote Detection
Detection of presence of Harmonic NSG 9000 Device. The script sends a HTTP GET connection request to the server and attempts to determine if the remote host runs Harmonic NSG 9000 Device from the response. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a...
Directory traversal
Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...
CVE-2018-14942
Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATIONGETFILE" or "POST /PY/EMULATIONEXPORT" with FileName=../../../passwd in the POST data...
Default credentials
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...
CVE-2018-14943
Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account...