CVE-2024-29972

TG Join Us https://t.me/WanLiChangChengWanLiChang Treten Sie uns bei, um regelmäßig verschiedene Schwachstellen-EXP und POC zu erhalten. CVE-2024-29972-EXP CVE-2024-29972 Zyxel NAS Backdoor Account – Unberechtigte Aktivierung des Hintertürkontos FOFA app="ZyXEL-NAS326" Hinweise Dieses EXP-Skript...

CVE-2022-30525_check

CVE-2022-30525check الوصف: يتحقق هذا السكربت من وجود ثغرة حقن أوامر نظام التشغيل CVE-2022-30525 في أجهزة Zyxel USG FLEX التي تعمل بإصدارات البرامج الثابتة من 5.00 حتى 5.21 Patch 1. تسمح هذه الثغرة للمهاجم بتعديل ملفات محددة وتنفيذ أوامر نظام التشغيل على الجهاز المتأثر. إرشادات الاستخدام: تأكد من...

Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting

Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the errmsg parameter freetimefailed.cgi CGI program, aka reflective cross-site scripting. id: CVE-2019-12581 info: name: Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting author: n-thumann...

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting

ZyXEL ZyWALL 2 Plus Internet Security Appliance contains a cross-site scripting vulnerability. Insecure URI handling leads to bypass of security restrictions, which allows an attacker to execute arbitrary JavaScript codes to perform multiple attacks. id: CVE-2021-46387 info: name: Zyxel ZyWALL 2...

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

Zyxel - Cross-Site Scripting

Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mpidx...

Zyxel - Authentication Bypass

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...

ZyXel USG - Hardcoded Credentials

A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. id: CVE-2020-29583 info: name: ZyXel USG - Hardcoded Credentials autho...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection

The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences /../, conduct directory traversal attacks, and view arbitrary files. id: CVE-2018-19326 info: name: Zyxel VMG1312-B10D...

Zyxel ZyWall UAG/USG - Account Creation Access

Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator via the "Free Time" component. This can lead to unauthorized network access or DoS attacks. id: CVE-2019-12583 info: name: Zyxel ZyWall UAG/USG - Account Creation...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

CVE-2024-29973

CVE-2024-29973 PoC e Scanner di Massa Panoramica Questo è un proof-of-concept PoC e scanner di massa per CVE-2024-29973: vulnerabilità di iniezione di comandi nei firmware Zyxel NAS326 versioni precedenti alla V5.21AAZF.17C0 e NAS542 versioni precedenti alla V5.21ABAG.14. Versione 1.0.2...

cve-2022-30525

CVE-2022-30525 di 1vere$k Rapid7 ha scoperto e segnalato una vulnerabilità che interessa i firewall Zyxel che supportano lo Zero Touch Provisioning ZTP, tra cui la serie ATP, la serie VPN e la serie USG FLEX incluse USG20-VPN e USG20W-VPN. La vulnerabilità, identificata come CVE-2022-30525,...

CVE-2022-30525

CVE-2022-30525 Iniezione di comandi nel firewall Zyxel CVE-2022-30525 POC&EXP author:160team.west9B Solo per uso da parte di ricercatori di sicurezza autorizzati, nel rispetto della legge sulla sicurezza informatica. L'utente si assume ogni responsabilità per eventuali conseguenze; l'autore non è...

CVE-2022-30525

CVE-2022-30525 Zyxel firewall vulnerabilità di iniezione di comandi remoti non autenticata Componenti interessati USG FLEX 100, 100W, 200, 500, 700 USG20-VPN, USG20W-VPN ATP 100, 200, 500, 700, 800 Versioni firmware ZLD5.00 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21 Patch 1 ZLD5.10 thru ZLD5.21...

victorian_machinery

Victorian Machinery Victorian Machinery è un exploit proof of concept per CVE-2022-30525. La vulnerabilità è una vulnerabilità di iniezione di comandi non autenticata e remota che colpisce i firewall Zyxel che supportano il zero touch provisioning. Zyxel ha rilasciato una correzione per questo...

vulns

भेद्यता रिपोर्ट HN Security के परामर्श। https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Solaris dtprintinfo और libXm/libXpm में कई भेद्यताएँ CVE-2022-46285, CVE-2023-24039, CVE-2023-24040। Zyxel HNS-2022-02-zyxel-zysh. Zyxel zysh में कई भेद्यताएँ CVE-2022-26531, CVE-2022-26532।...

advisories

advisories "Tests können das Vorhandensein von Fehlern zeigen, aber nicht deren Abwesenheit." -- Edsger W. Dijkstra Eine Sammlung meiner öffentlichen Security-Advisories. Siehe auch https://github.com/hnsecurity/vulns https://hnsecurity.it/blog/author/marco-ivaldi/ Advisories Linux CVE-2006-1242...

zyxel-social-login-bypass-cve-2026-8508

CVE-2026-8508: Zyxel-Captive-Portal-Bypass über vertrauenswürdige, vom Browser übermittelte Facebook-Identität Dieses Repository bündelt den öffentlichen Writeup, das Schnellverifizierungsskript und ausgewählte unterstützende Artefakte für CVE-2026-8508. Worum es geht CVE-2026-8508 ist eine...