zyxel usg_flex_50_firmware CVEs

CVE-2023-34141

Published Jul 17, 2023

A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware version…

CVSS 8.0 · High

Vendor/product tagsBeta · best-effort

CVE-2023-34140

Published Jul 17, 2023

A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) s…

CVSS 6.5 · Medium

Vendor/product tagsBeta · best-effort

CVE-2023-34139

Published Jul 17, 2023

A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4…

CVSS 8.8 · High

Vendor/product tagsBeta · best-effort

CVE-2023-34138

Published Jul 17, 2023

A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 thr…

CVSS 8.0 · High

Vendor/product tagsBeta · best-effort

CVE-2023-33012

Published Jul 17, 2023

A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5…

CVSS 8.8 · High

Vendor/product tagsBeta · best-effort

CVE-2023-33011

Published Jul 17, 2023

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) ser…

CVSS 8.8 · High

Vendor/product tagsBeta · best-effort

CVE-2023-28767

Published Jul 17, 2023

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36,…

CVSS 8.8 · High

Vendor/product tagsBeta · best-effort

CVE-2023-33010

Published May 24, 2023

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36…

CVSS 9.8 · Critical

evidence mentions: 11
Buzz score: 62.9

KEV listed

Vendor/product tagsBeta · best-effort

CVE-2023-33009

Published May 24, 2023

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 P…

CVSS 9.8 · Critical

evidence mentions: 11
Buzz score: 62.9

KEV listed

Vendor/product tagsBeta · best-effort

CVE-2023-28771

Published Apr 25, 2023

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4…

CVSS 9.8 · Critical

evidence mentions: 26
Buzz score: 69.5

KEV listed

Vendor/product tagsBeta · best-effort

CVE-2023-27991

Published Apr 24, 2023

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through…

CVSS 8.8 · High

evidence mentions: 3
Buzz score: 20.4

Vendor/product tagsBeta · best-effort

CVE-2023-27990

Published Apr 24, 2023

The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware…

CVSS 4.8 · Medium

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2023-22918

Published Apr 24, 2023

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through…

CVSS 6.5 · Medium

Vendor/product tagsBeta · best-effort

CVE-2023-22917

Published Apr 24, 2023

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG F…

CVSS 7.5 · High

Vendor/product tagsBeta · best-effort

CVE-2023-22916

Published Apr 24, 2023

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 throug…

CVSS 8.1 · High

Vendor/product tagsBeta · best-effort

CVE-2023-22915

Published Apr 24, 2023

A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through…

CVSS 7.5 · High

Vendor/product tagsBeta · best-effort

CVE-2023-22914

Published Apr 24, 2023

A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5…

CVSS 7.2 · High

Vendor/product tagsBeta · best-effort

CVE-2023-22913

Published Apr 24, 2023

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmwa…

CVSS 8.1 · High

Vendor/product tagsBeta · best-effort

CVE-2022-38547

Published Feb 7, 2023

A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through…

CVSS 7.2 · High

Vendor/product tagsBeta · best-effort

zyxel / usg_flex_50_firmware CVEs