CVE-2023-6397

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service DoS conditions by downloading a crafted RAR compressed fil...

Null pointer dereference

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service DoS conditions by downloading a crafted RAR compressed fil...

Format string

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN series firmware versions from 4.16 through 5.37...

CVE-2023-6764

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, and USG20W-VPN series...

CVE-2023-6764

CVE-2023-6764 is a format-string vulnerability in Zyxel devices’ IPSec VPN functionality. Affected products and versions include Zyxel ATP series firmware 4.32–5.37 Patch 1, USG FLEX series 4.50–5.37 Patch 1, USG FLEX 50(W) 4.16–5.37 Patch 1, and USG20(W)-VPN 4.16–5.37 Patch 1. An attacker could ...

CVE-2023-6764

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, and USG20W-VPN series...

CVE-2023-6399

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN series firmware versions from 4.16 through 5.37...

CVE-2023-6399

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN series firmware versions from 4.16 through 5.37...

CVE-2023-6398

CVE-2023-6398 is a post-authentication command-injection vulnerability in Zyxel devices where the file upload binary can be abused by an authenticated administrator to execute OS commands on the device via FTP. Affected products include ZyXEL ATP series (4.32–5.37 Patch 1), USG FLEX series (4.50–...

CVE-2023-6398

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN...

CVE-2023-6398

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN...

CVE-2023-6397

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service DoS conditions by downloading a crafted RAR compressed fil...

CVE-2023-6397

A null pointer dereference in Zyxel ATP series firmware 4.32–5.37 Patch 1 and USG FLEX series firmware 4.50–5.37 Patch 1, within the Anti-Malware feature, can allow a LAN-based attacker to cause DoS by sending a crafted RAR file to a LAN-side host. Affected products: Zyxel ATP and USG FLEX. Impac...

CVE-2023-6397

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service DoS conditions by downloading a crafted RAR compressed fil...

PT-2023-8710 · Zyxel · Zyxel Atp Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 Zyxel USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 Zyxel USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1 Zyxel USG20W-VPN series firmwa...

The vulnerability of the fbwifi_forward.cgi component of the Zyxel USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN network devices allows a hacker to cause service interruptions.

The vulnerability of the fbwififorward.cgi component of the Zyxel USG FLEX, USG FLEX 50W, USG20W-VPN, and VPN networking devices is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions b...

The vulnerability of the account_print.cgi component in the microprogramming software for Zyxel USG FLEX and VPN devices allows a hacker to execute arbitrary commands.

The vulnerability of the accountprint.cgi component in the Zyxel USG FLEX and VPN network devices is related to an incorrect limitation on the path name to the tmp directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Vulnerabilities fixed in Zyxel products

Zyxel has fixed vulnerabilities in the firmware of several ATP and USG series firewalls. A malicious party could exploit them to launch attacks that can result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Access to system data...

The vulnerability of the Wi-Fi hotspot implementation of the microprogramming software for network devices ZyXEL USG FLEX and VPN allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Wi-Fi hotspot technology implemented in ZyXEL USG FLEX and VPN network devices is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

The vulnerability of the microprogrammed software of ZyXEL VPN, USG FLEX, and ATP lies in the fact that operation outputs go beyond the buffer in memory, allowing a intruder to cause a service failure.

The vulnerability of the microprogrammed network devices ZyXEL VPN, USG FLEX, and ATP lies in the fact that the operation values escape outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by executing a command to flush system logs...