Logic Flaw Vulnerability in Qixing Tian Please Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a logic flaw vulnerability in Qixing Tian please Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...

CVE-2021-35029

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected devi...

CVE-2021-35029

The CVE-2021-35029 entry describes an authentication bypass in the web-based management interface of Zyxel devices (USG/Zywall series firmware 4.35–4.64 and USG Flex/ATP/VPN series firmware 4.35–5.01) that could allow a remote attacker to execute arbitrary commands on an affected device. The conn...

Command Execution Vulnerability in Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a command execution vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain server control privileges...

Command Execution Vulnerability in Tianqing Hanma USG Firewall (CNVD-2021-41975)

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a command execution vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain server control privileges...

CVE-2020-9213

There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft many specific packets. Successful exploit may cause some services to be abnormal. Affected products include some versions of NGFW Module,...

Weak password vulnerability in Qixing Tianqing Hanma USG Firewall (CNVD-2021-24737)

Tianqing HANMAR USG Firewall is developed based on Qixing ISE unified engine, there is no OEM from third-party functions, and the functions can be split in any combination, which has very little impact on the system performance. There is a weak password vulnerability in Qisda Tianqing Hanma USG...

Weak Password Vulnerability in Huawei's USG Firewall

Huawei USG Firewall is a firewall from Huawei for small businesses, branch offices, sales outlets, community service stations, and other scenarios. Huawei USG Firewall suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Logic Flaw Vulnerability in Qixing Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is developed based on Qixing ISE unified engine, there is no OEM from third-party functions, and the functions can be split in any combination, which has very little impact on system performance. Adopting multi-core hardware architecture and integrated software design,...

Weak Password Vulnerability in Tianqing Hanma USG Firewall of Beijing Qixing Information Security Technology Co.

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a weak password vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...

Weak Password Vulnerability in Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product officially launched by Qixing. There is a weak password vulnerability in Tianqing Hanma USG Firewall. Attackers can use the default account to enter the management interface and obtain sensitive information...

CVE-2020-29299

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

Command injection

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

CVE-2020-29299

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

CVE-2020-29299

CVE-2020-29299 affects Zyxel SD-OS/On-Premise lines (VPN On-Premise, VPN Orchestrator, USG, USG FLEX, ATP, NSG). A command injection occurs via an admin-provided input string to chg_exp_pwd during a password-change action. Root cause stated in multiple sources: lack of input validation/cleanup in...

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...

Default credentials

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...

CVE-2020-29583 Zyxel USG Hard-Coded Admin Creds

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges. Recent...

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...