CVE-2023-22914

A path traversal vulnerability in the “accountprint.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS command...

CVE-2023-22915

A buffer overflow vulnerability in the “fbwififorward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.30 through 5.35, USG20W-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could...

CVE-2023-22916

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...

CVE-2023-22917

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-27990

The cross-site scripting XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through...

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-22915

CVE-2023-22915 affects Zyxel USG FLEX family (USG FLEX 4.50–5.35; USG FLEX 50(W) 4.30–5.35; USG20(W)-VPN 4.30–5.35; VPN series 4.30–5.35). Root cause: buffer overflow in fbwifi_forward.cgi when Facebook WiFi is enabled. Impact: remote unauthenticated attacker can cause Denial-of-Service by sendin...

CVE-2023-22914: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the “accountprint.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS command...

CVE-2023-22913: Improper Neutralization of Special Elements used in a Command

A post-authentication command injection vulnerability in the “accountoperator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data,...

CVE-2023-22915: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability in the “fbwififorward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.30 through 5.35, USG20W-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could...

PT-2023-8181 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 5.10 through 5.35 Zyxel USG FLEX series versions 5.00 through 5.35 Zyxel USG FLEX 50W versions 5.10 through 5.35 Zyxel USG20W-VPN versions 5.10 through 5.35 Zyxel VPN series versions 5.00 through 5.35 Description: Th...

PT-2023-7789 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

Zyxel ATP cross-site scripting vulnerability

Zyxel ATP is a firewall from China Heqin Zyxel. A cross-site scripting vulnerability exists in multiple Zyxel products. The vulnerability is exploited by attackers to conduct cross-site scripting attacks. The following products and versions are affected: Zyxel ATP version 4.32 through 5.35, USG...

Zyxel USG FLEX command injection vulnerability

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. Offering flexible VPN options IPsec, SSL or L2TP, it provides flexible and secure remote access for remote work and management. A security vulnerability exists in the Zyxel USG FLEX Series 4.50 to 5.35 firmware versions, and the VPN Series 4....

CVE-2023-22917

A buffer overflow vulnerability in the “sdwanifaceipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50W firmware versions 5.10 through 5.32, USG20W-VPN firmware versions 5.10 through 5.32, and VPN series firmware...

CVE-2023-22918

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, VPN series...

PT-2023-7790 · Zyxel · Zyxel Usg Flex Series +4

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.35 Zyxel USG FLEX series versions 4.50 through 5.35 Zyxel USG FLEX 50W versions 4.16 through 5.35 Zyxel USG20W-VPN versions 4.16 through 5.35 Zyxel VPN series versions 4.30 through 5.35 Description: Th...

CVE-2023-22914

CVE-2023-22914 affects Zyxel USG FLEX (firmware 4.50–5.35) and VPN series (4.30–5.35). The root cause is a path traversal in account_print.cgi that can let a remote authenticated administrator execute OS commands in the tmp directory by uploading a crafted file when the hotspot function is enable...

CVE-2023-22917

CVE-2023-22917 is a buffer overflow in Zyxel sdwan_iface_ipc used by Zyxel ATP/USG/FLEX/VPN firmware. The flaw allows a remote unauthenticated attacker to cause a core dump via a crafted configuration file upload, affecting Zyxel products (ATP 5.10–5.32; USG FLEX 5.00–5.32; USG FLEX 50(W) 5.10–5....

CVE-2023-22916: Improper Input Validation

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...