|
2022-05-24
|
CVE-2022-0734
|
A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Usg200_firmware, Usg20_firmware, Usg210_firmware, Usg2200_firmware, Usg300_firmware, Usg310_firmware, Usg_1100_firmware, Usg_110_firmware, Usg_1900_firmware, Usg_20w\-Vpn_firmware, Usg_20w_firmware, Usg_2200\-Vpn_firmware, Usg_310_firmware, Usg_40_firmware, Usg_40w_firmware, Usg_60_firmware, Usg_60w_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware
|
6.1
|
|
|
|
2022-05-24
|
CVE-2022-0910
|
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Usg200_firmware, Usg20_firmware, Usg210_firmware, Usg2200_firmware, Usg300_firmware, Usg310_firmware, Usg_1100_firmware, Usg_110_firmware, Usg_1900_firmware, Usg_20w\-Vpn_firmware, Usg_20w_firmware, Usg_2200\-Vpn_firmware, Usg_310_firmware, Usg_40_firmware, Usg_40w_firmware, Usg_60_firmware, Usg_60w_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware
|
6.5
|
|
|
|
2022-05-24
|
CVE-2022-26532
|
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5)...
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Nap203_firmware, Nap303_firmware, Nap353_firmware, Nsg100_firmware, Nsg300_firmware, Nsg50_firmware, Nwa110ax_firmware, Nwa1123\-Ac\-Hd_firmware, Nwa1123\-Ac\-Pro_firmware, Nwa1123acv3_firmware, Nwa1302\-Ac_firmware, Nwa210ax_firmware, Nwa50ax_firmware, Nwa5123\-Ac\-Hd_firmware, Nwa55axe_firmware, Nwa90ax_firmware, Nxc2500_firmware, Nxc5500_firmware, Usg200_firmware, Usg20_firmware, Usg210_firmware, Usg2200_firmware, Usg300_firmware, Usg310_firmware, Usg_1100_firmware, Usg_110_firmware, Usg_1900_firmware, Usg_20w\-Vpn_firmware, Usg_20w_firmware, Usg_2200\-Vpn_firmware, Usg_310_firmware, Usg_40_firmware, Usg_40w_firmware, Usg_60_firmware, Usg_60w_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware, Wac500_firmware, Wac500h_firmware, Wac5302d\-S_firmware, Wac5302d\-Sv2_firmware, Wac6103d\-I_firmware, Wac6303d\-S_firmware, Wac6502d\-E_firmware, Wac6502d\-S_firmware, Wac6503d\-S_firmware, Wac6552d\-S_firmware, Wac6553d\-S_firmware, Wax510d_firmware, Wax610d_firmware, Wax630s_firmware, Wax650s_firmware
|
7.8
|
|
|
|
2022-05-24
|
CVE-2022-26531
|
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version...
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Nap203_firmware, Nap303_firmware, Nap353_firmware, Nsg100_firmware, Nsg300_firmware, Nsg50_firmware, Nwa110ax_firmware, Nwa1123\-Ac\-Hd_firmware, Nwa1123\-Ac\-Pro_firmware, Nwa1123acv3_firmware, Nwa1302\-Ac_firmware, Nwa210ax_firmware, Nwa50ax_firmware, Nwa5123\-Ac\-Hd_firmware, Nwa55axe_firmware, Nwa90ax_firmware, Nxc2500_firmware, Nxc5500_firmware, Usg200_firmware, Usg20_firmware, Usg210_firmware, Usg2200_firmware, Usg300_firmware, Usg310_firmware, Usg_1100_firmware, Usg_110_firmware, Usg_1900_firmware, Usg_20w\-Vpn_firmware, Usg_20w_firmware, Usg_2200\-Vpn_firmware, Usg_310_firmware, Usg_40_firmware, Usg_40w_firmware, Usg_60_firmware, Usg_60w_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware, Wac500_firmware, Wac500h_firmware, Wac5302d\-S_firmware, Wac5302d\-Sv2_firmware, Wac6103d\-I_firmware, Wac6303d\-S_firmware, Wac6502d\-E_firmware, Wac6502d\-S_firmware, Wac6503d\-S_firmware, Wac6552d\-S_firmware, Wac6553d\-S_firmware, Wax510d_firmware, Wax610d_firmware, Wax630s_firmware, Wax650s_firmware
|
7.8
|
|
|
|
2022-07-19
|
CVE-2022-2030
|
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32...
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Usg20\-Vpn_firmware, Usg20w\-Vpn_firmware, Usg40_firmware, Usg40w_firmware, Usg60_firmware, Usg60w_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware, Zywall_1100_firmware, Zywall_110_firmware, Zywall_310_firmware
|
6.5
|
|
|
|
2022-07-19
|
CVE-2022-30526
|
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL...
|
Atp100_firmware, Atp100w_firmware, Atp200_firmware, Atp500_firmware, Atp700_firmware, Atp800_firmware, Usg20\-Vpn_firmware, Usg20w\-Vpn_firmware, Usg40_firmware, Usg40w_firmware, Usg60_firmware, Usg60w_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Vpn1000_firmware, Vpn100_firmware, Vpn300_firmware, Vpn50_firmware, Zywall_1100_firmware, Zywall_110_firmware, Zywall_310_firmware
|
7.8
|
|
|
|
2023-07-17
|
CVE-2023-28767
|
The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5.10 through 5.36,
USG20(W)-VPN series firmware versions 5.10 through 5.36, and VPN series firmware versions 5.00 through 5.36. An unauthenticated, LAN-based attacker could leverage the vulnerability to inject some operating system (OS) commands into the device...
|
Usg_20w\-Vpn_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Zywall_atp100_firmware, Zywall_atp100w_firmware, Zywall_atp200_firmware, Zywall_atp500_firmware, Zywall_atp700_firmware, Zywall_atp800_firmware, Zywall_vpn100_firmware, Zywall_vpn2s_firmware, Zywall_vpn300_firmware, Zywall_vpn50_firmware, Zywall_vpn_100_firmware, Zywall_vpn_300_firmware, Zywall_vpn_50_firmware
|
N/A
|
|
|
|
2023-07-17
|
CVE-2023-33011
|
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device...
|
Usg_20w\-Vpn_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Zywall_atp100_firmware, Zywall_atp100w_firmware, Zywall_atp200_firmware, Zywall_atp500_firmware, Zywall_atp700_firmware, Zywall_atp800_firmware, Zywall_vpn100_firmware, Zywall_vpn2s_firmware, Zywall_vpn300_firmware, Zywall_vpn50_firmware, Zywall_vpn_100_firmware, Zywall_vpn_300_firmware, Zywall_vpn_50_firmware
|
N/A
|
|
|
|
2023-07-17
|
CVE-2023-33012
|
A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE...
|
Usg_20w\-Vpn_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Zywall_atp100_firmware, Zywall_atp100w_firmware, Zywall_atp200_firmware, Zywall_atp500_firmware, Zywall_atp700_firmware, Zywall_atp800_firmware, Zywall_vpn100_firmware, Zywall_vpn2s_firmware, Zywall_vpn300_firmware, Zywall_vpn50_firmware, Zywall_vpn_100_firmware, Zywall_vpn_300_firmware, Zywall_vpn_50_firmware
|
N/A
|
|
|
|
2023-07-17
|
CVE-2023-34138
|
A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.60 through 5.36 Patch 2, and VPN series firmware versions 4.60 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands on an affected device if...
|
Usg_20w\-Vpn_firmware, Usg_2200\-Vpn_firmware, Usg_flex_100_firmware, Usg_flex_100w_firmware, Usg_flex_200_firmware, Usg_flex_500_firmware, Usg_flex_50_firmware, Usg_flex_50w_firmware, Usg_flex_700_firmware, Zywall_atp100_firmware, Zywall_atp100w_firmware, Zywall_atp200_firmware, Zywall_atp500_firmware, Zywall_atp700_firmware, Zywall_atp800_firmware, Zywall_vpn100_firmware, Zywall_vpn2s_firmware, Zywall_vpn300_firmware, Zywall_vpn50_firmware, Zywall_vpn_100_firmware, Zywall_vpn_300_firmware, Zywall_vpn_50_firmware
|
N/A
|
|
|