patch-CVE-2026-04321

Patch: CVE-2026-04321 Vulnerability Details CVE : CVE-2026-04321 Product : Zyxel firewall Description : OS command injection Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-01-28 Status| deployed Deployed To| Production Validated By| SecOps Team References NVD CIS...

CVE-2022-30525

CVE-2022-30525 Уязвимость внедрения команд в брандмауэре Zyxel CVE-2022-30525 POC&EXP author:160team.west9B Только для использования авторизованными исследователями безопасности, соблюдайте закон о кибербезопасности. Любые проблемы и последствия – на вашей ответственности, автор не несет...

CVE-2024-29973

CVE-2024-29973 PoC 및 대량 스캐너 개요 이것은 CVE-2024-29973에 대한 개념 증명PoC 및 대량 스캐너입니다: Zyxel NAS326 펌웨어 버전 V5.21AAZF.17C0 이전 및 NAS542 펌웨어 버전 V5.21ABAG.14 이전의 명령 주입 취약점. 버전 1.0.2 root@kitploit: - 페이로드 메커니즘 수정. 언급해 주신 https://github.com/p0et08/ 님께 감사드립니다. 사용 방법 단일 대상 스캔 단일 대상을 스캔하려면: root@kitploit: python...

Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting

Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the errmsg parameter freetimefailed.cgi CGI program, aka reflective cross-site scripting. id: CVE-2019-12581 info: name: Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting author: n-thumann...

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting

ZyXEL ZyWALL 2 Plus Internet Security Appliance contains a cross-site scripting vulnerability. Insecure URI handling leads to bypass of security restrictions, which allows an attacker to execute arbitrary JavaScript codes to perform multiple attacks. id: CVE-2021-46387 info: name: Zyxel ZyWALL 2...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection

The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

Zyxel - Cross-Site Scripting

Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mpidx...

Zyxel - Authentication Bypass

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...

ZyXel USG - Hardcoded Credentials

A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. id: CVE-2020-29583 info: name: ZyXel USG - Hardcoded Credentials autho...

Zyxel ZyWall UAG/USG - Account Creation Access

Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. id: CVE-2019-12583 info: name: Zyxel ZyWall UAG/USG - Account Creation...

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences /../, conduct directory traversal attacks, and view arbitrary files. id: CVE-2018-19326 info: name: Zyxel VMG1312-B10D...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

zyxel-cve-2021-35036-super-admin-password-leak

CVE-2021-35036: Zyxel Super-Admin Password Leak Analysis This repository contains the public write-up and lab files for CVE-2021-35036. The issue was reported against Zyxel VMG3625-T50B firmware and centered on DAL getter paths that returned higher-privilege local-account and remote-management...

victorian_machinery

Victorian Machinery Victorian Machinery is a proof of concept exploit for CVE-2022-30525. The vulnerability is an unauthenticated and remote command injection vulnerability affecting Zyxel firewall's that support zero touch provisioning. Zyxel pushed a fix for this issue on April 28, 2022. The...

CVE-2026-6837-zyxel-export-cgi-command-injection

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection This repository packages the public writeup, quick verification script, and supporting evidence for CVE-2026-6837. What this is CVE-2026-6837 is a post-authentication command-injection flaw in Zyxel's export-cgi handler. On the...

zyxel-social-login-bypass-cve-2026-8508

CVE-2026-8508: 브라우저가 제출한 Facebook ID를 신뢰하여 발생하는 Zyxel Captive-Portal 우회 이 저장소는 CVE-2026-8508에 대한 공개 분석 문서writeup, 빠른 검증 스크립트, 그리고 선별된 지원 아티팩트를 패키징합니다. 개요 CVE-2026-8508은 Zyxel captive-portal 소셜 로그인의 인증 전pre-authentication 신뢰 경계trust-boundary 결함입니다. 여기의 로컬 리버스 작업은 WAX650S V7.10ABRM.4C0에 기반을 두었습니다:...

CVE-2024-29973

CVE-2024-29973 – Sicherheitslücke zur Remote-Befehlsinjektion Beschreibung Bei CVE-2024-29973 handelt es sich um eine kritische Sicherheitslücke in bestimmten Netzwerkgeräten von Zyxel. Diese Schwachstelle ermöglicht es einem nicht authentifizierten Angreifer, beliebige Befehle auf dem Zielgerät...

CVE-2024-29972

TG Join Us https://t.me/WanLiChangChengWanLiChang Treten Sie uns bei, um regelmäßig verschiedene Schwachstellen-EXP und POC zu erhalten. CVE-2024-29972-EXP CVE-2024-29972 Zyxel NAS Backdoor Account – Unberechtigte Aktivierung des Hintertürkontos FOFA app="ZyXEL-NAS326" Hinweise Dieses EXP-Skript...

CVE-2022-30525_check

CVE-2022-30525check الوصف: يتحقق هذا السكربت من وجود ثغرة حقن أوامر نظام التشغيل CVE-2022-30525 في أجهزة Zyxel USG FLEX التي تعمل بإصدارات البرامج الثابتة من 5.00 حتى 5.21 Patch 1. تسمح هذه الثغرة للمهاجم بتعديل ملفات محددة وتنفيذ أوامر نظام التشغيل على الجهاز المتأثر. إرشادات الاستخدام: تأكد من...