453 matches found
Cross site scripting
A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...
CVE-2022-40603
A cross-site scripting XSS vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an...
CVE-2022-40603
The CVE-2022-40603 issue is an XSS vulnerability in the CGI program of Zyxel ZyWALL/USG family devices and related lines (USG, ZyWALL, USG FLEX, VPN, ATP). Affected firmware ranges include ZyWALL/USG 4.30–4.72, VPN 4.30–5.31, USG FLEX 4.50–5.31, and ATP 4.32–5.31. The underlying impact is that an...
Weak password vulnerability in Tianqing Hanma USG of Qixing Information Technology Group Co.
Tianqing Hanma USG is a new firewall series product officially launched by Qixing. The Tianqing Hanma USG of Qixing Information Technology Group Co., Ltd. suffers from a weak password vulnerability, which can be exploited by attackers to obtain sensitive information...
Zyxel Unified Security Gateway (USG) Web Detection
Binary data zyxelusgwebdetect.nbin...
Zyxel Firewall SUID Binary Privilege Escalation Exploit
This Metasploit module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an...
Zyxel Firewall SUID Binary Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zyxel Firewall SUID Binary Privilege Escalation', 'Description' = %q This module exploits CVE-2022-30526, a local privilege escalation...
The vulnerability of the command-line interface (CLI) of Zyxell USG FLEX, ATP, and VPN network interfaces allows a hacker to execute arbitrary commands with root privileges.
The vulnerability of the command-line interface CLI of Zyxell USG FLEX, ATP, and VPN network interfaces relates to the possibility of rewriting files with arbitrary content. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...
CVE-2022-30526
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...
CVE-2022-2030
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...
Directory traversal
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...
Privilege escalation
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...
CVE-2022-2030
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 throu...
CVE-2022-2030
CVE-2022-2030 describes an authenticated directory traversal in Zyxel firewall/USG/ZyWALL CGI programs. Affected products/versions include Zyxel USG FLEX 100(W) (4.50–5.30), USG FLEX 200 (4.50–5.30), USG FLEX 500 (4.50–5.30), USG FLEX 700 (4.50–5.30), USG FLEX 50(W) (4.16–5.30), USG20(W)-VPN (4.1...
CVE-2022-30526
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...
CVE-2022-30526
CVE-2022-30526 affects Zyxel USG FLEX/USGZyWALL firewalls (e.g., USG FLEX 100(W), 200, 500, 700; USG FLEX 50(W); USG20(W)-VPN; ATP; VPN series; USG/ZyWALL). The issue is a local privilege escalation via the CLI caused by a SUID binary that allows a low-privileged user to copy files as root and ov...
Zyxel USG FLEX 路径遍历漏洞
Zyxel USG FLEX is a firewall from China-based Hopkins Technology Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel products that stems from a directory traversal...
PT-2022-3781 · Zyxel · Zyxel Usg/Zywall Series +8
Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX 100W versions 4.50 through 5.30 Zyxel USG FLEX 200 versions 4.50 through 5.30 Zyxel USG FLEX 500 versions 4.50 through 5.30 Zyxel USG FLEX 700 versions 4.50 through 5.30 Zyxel USG FLEX 50W versions 4.16 through 5.30 Zyxel...
Zyxel Firewall SUID Binary Privilege Escalation
This module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker...
