CVE-2022-30525

CVE-2022-30525 Vulnerabilidad de inyección de comandos remotos no autenticada en el firewall Zyxel Componentes afectados USG FLEX 100, 100W, 200, 500, 700 USG20-VPN, USG20W-VPN ATP 100, 200, 500, 700, 800 Versiones de firmware ZLD5.00 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21 Patch 1 ZLD5.10 thru...

cve-2022-30525

CVE-2022-30525 por 1vere$k Rapid7 descubrió y reportó una vulnerabilidad que afecta a los firewalls de Zyxel compatibles con Zero Touch Provisioning ZTP, incluidas las series ATP, VPN y USG FLEX incluidos USG20-VPN y USG20W-VPN. La vulnerabilidad, identificada como CVE-2022-30525, permite a un...

CVE-2022-30525_Exploit

CVE-2022-30525 Inyección remota de comandos en firewall Zyxel Un exploit basado en Python para CVE-2022-30525 Resumen de la vulnerabilidad NIST Una vulnerabilidad de inyección de comandos del sistema operativo en el programa CGI de las versiones de firmware 5.00 hasta 5.21 Patch 1 ambas incluidas...

CVE-2022-30525_check

CVE-2022-30525check Descripción: Este script verifica la presencia de la vulnerabilidad de inyección de comandos del sistema operativo CVE-2022-30525 en dispositivos Zyxel USG FLEX que ejecutan versiones de firmware 5.00 a 5.21 Parche 1. La vulnerabilidad permite a un atacante modificar archivos...

CVE-2022-30525

CVE-2022-30525 Inyección de comandos remotos no autenticados en firewall Zyxel Versiones afectadas Componentes afectados USG FLEX 100, 100W, 200, 500, 700 USG20-VPN, USG20W-VPN ATP 100, 200, 500, 700, 800 Versiones de firmware ZLD5.00 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21 Patch 1 ZLD5.10 thru...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 ./CVE-2021-36260.py --rhost 192.168.57.20 --rport 8080 --check Comprobación de vulnerabilidad/verificación segura e insegura: solo se usará la 'comprobación insegura' si no se verifica con la 'comprobación segura' $./CVE-2021-36260.py --rhost 192.168.57.20 --rport 80...

CVE-2022-30525

CVE-2022-30525 Inyección de comandos remota en Zyxel Firewall Un exploit basado en Python para CVE-2022-30525 Resumen de la vulnerabilidad NIST Una vulnerabilidad de inyección de comandos del sistema operativo en el programa CGI de Zyxel USG FLEX 100W, con versiones de firmware de la 5.00 a la 5....

CVE-2026-14818

CVE-2026-14818 describes a path traversal vulnerability in the CLI command used to execute configuration files on Zyxel devices. Affected firmware ranges include Zyxel ATP series (V4.32–V5.42 Patch 1), USG FLEX series (V4.50–V5.42 Patch 1), USG FLEX 50(W) series (V4.16–V5.42 Patch 1), and USG20(W...

CVE-2026-14818

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

PT-2026-67635

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

CVE-2026-14818: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

CVE-2025-11730

A post‑authentication command injection vulnerability in the Dynamic DNS DDNS configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50W series firmware versions from V5.35 through V5.41, and...

CVE-2025-11730: Improper Neutralization of Special Elements used in an OS Command

A post‑authentication command injection vulnerability in the Dynamic DNS DDNS configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50W series firmware versions from V5.35 through V5.41, and...

CVE-2025-1732

An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable...

CVE-2025-1731

An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting...

CVE-2025-9133

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50W series firmware versions from V4.16 through V5.40, and USG20W-VPN series firmware versions from V4.16 through V5.40 could...

CVE-2025-9133

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50W series firmware versions from V4.16 through V5.40, and USG20W-VPN series firmware versions from V4.16 through V5.40 could...

CVE-2025-9133

A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50W series firmware versions from V4.16 through V5.40, and USG20W-VPN series firmware versions from V4.16 through V5.40 could...

CVE-2025-9133

Summary of CVE-2025-9133 (Zyxel devices) Technical details in the connected PT-2025-42828 entry show a missing authorization flaw in Zyxel ATP series, Zyxel USG FLEX series, and Zyxel USG20(W)-VPN devices. The vulnerability arises from insufficient input validation/logic in the CGI interface, spe...

CVE-2025-8078

CVE-2025-8078 describes a post-authentication command-injection vulnerability in Zyxel devices: Zyxel ATP series firmware v4.32–v5.40, USG FLEX series v4.50–v5.40, USG FLEX 50(W) series v4.16–v5.40, and USG20(W)-VPN series v4.16–v5.40. An authenticated administrator can pass a crafted string as a...