CVE-2023-4397

The CVE-2023-4397 issue is a buffer overflow in Zyxel ATP/USG firmware (5.37 primarily) that can be triggered by an authenticated local attacker with administrator privileges via crafted CLI strings, leading to DoS. Affected: Zyxel ATP series, USG FLEX series, USG FLEX 50(W), USG20(W)-VPN; root c...

CVE-2023-37926

The CVE-2023-37926 issue affects Zyxel devices including ATP series 4.32–5.37, USG FLEX series 4.50–5.37, USG FLEX 50(W) 4.16–5.37, USG20(W)-VPN 4.16–5.37, and VPN series 4.30–5.37. It is a buffer overflow in firmware that enables an authenticated local attacker to cause denial-of-service by runn...

CVE-2023-37925

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-37925

CVE-2023-37925 describes an improper privilege management vulnerability in the debug CLI command on Zyxel devices (ATP series 4.32–5.37; USG FLEX series 4.50–5.37; USG FLEX 50(W) 4.16–5.37; USG20(W)-VPN 4.16–5.37; VPN 4.30–5.37; NWA50AX 6.29(ABYW.2); WAC500 6.65(ABVS.1); WAX300H 6.60(ACHF.1); WBE...

CVE-2023-35139

Summary of CVE-2023-35139 : A cross-site scripting (XSS) vulnerability exists in the CGI program of Zyxel ATP series (5.10–5.37), USG FLEX series (5.00–5.37), USG FLEX 50(W) (5.10–5.37), USG20(W)-VPN (5.10–5.37), and VPN series (5.00–5.37). An unauthenticated LAN-based attacker could store malici...

CVE-2023-35139

A cross-site scripting XSS vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG FLEX 50W series firmware versions 5.10 through 5.37, USG20W-VPN series firmware versions 5.10 through 5.37, and VPN...

CVE-2023-35136

An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and...

CVE-2023-35136

CVE-2023-35136 describes an improper input validation vulnerability in the Quagga package across Zyxel devices (ATP series 4.32–5.37; USG FLEX 4.50–5.37; USG FLEX 50(W) 4.16–5.37; USG20(W)-VPN 4.16–5.37; VPN series 4.30–5.37) that could allow an authenticated local attacker to access configuratio...

Zyxel ATP Input Validation Error Vulnerability

Zyxel ATP is a firewall from China-based Heqin Zyxel. The Zyxel ATP suffers from an input validation error vulnerability that stems from an incorrect input validation vulnerability in the Quagga program package, which allows an authenticated, local attacker to access configuration files on the...

Zyxel USG FLEX Security Vulnerability

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel USG FLEX series firmware versions 4.50 to 5.37, VPN series firmware...

PT-2023-7186 · Zyxel · Zyxel Usg Flex Series +5

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions 4.32 through 5.37 Zyxel USG FLEX series firmware versions 4.50 through 5.37 Zyxel USG FLEX 50W series firmware versions 4.16 through 5.37 Zyxel USG20W-VPN series firmware versions 4.16 through 5.37 Zyxel VPN...

PT-2023-7252 · Zyxel · Zyxel Vpn +1

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX series firmware versions 4.50 through 5.37 Zyxel VPN series firmware versions 4.30 through 5.37 Description: The issue is related to improper privilege management in the hotspot feature of the affected devices. This could allow...

PT-2023-7251 · Zyxel · Zyxel Usg Flex Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series version 5.37 Zyxel USG FLEX series version 5.37 Zyxel USG FLEX 50W series version 5.37 Zyxel USG20W-VPN series version 5.37 Description: A buffer overflow issue in the firmware could allow an authenticated local attacker with...

The vulnerability of the Cloud Management mode of the Zyxel USG FLEX, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN software allows a hacker to execute arbitrary commands.

The vulnerability of the Cloud Management mode of Zyxel USG FLEX, USG FLEX 50W, USG20W-VPN, ATP, and VPN software lies in the lack of measures taken to neutralize the special elements used in the operating system. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

Zyxel USG < 5.37 Command Injection (CVE-2023-28767)

Firmware version of the Zyxel USG, ATP, or VPN is less than 5.37 and is affected by a vulnerability. The configuration parser fails to sanitize user-controlled input. An unauthenticated, LAN-based attacker could leverage the vulnerability to inject some operating system OS commands into the devic...

CVE-2023-34138

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50W series firmware versions 4.60 through 5.36 Patch 2, USG20W-VPN series firmware version...

CVE-2023-34139

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affecte...

CVE-2023-34141

A command injection vulnerability in the access point AP management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.00 through 5.36 Patch 2, USG20W-VPN series firmware...

CVE-2023-33011

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

CVE-2023-34140

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50W series firmware versions 4.16 through 5.36 Patch 2, USG20W-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN...