# cve.now: Zyxel

The newest entries naming Zyxel as an affected vendor (up to 200), of 172 in all, 10 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-76955](https://cve.now/CVE-2026-76955.md): A buffer overflow vulnerability in the zdp\_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based… (CVSS 8.8)
- [CVE-2026-107441](https://cve.now/CVE-2026-107441.md): An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an… (CVSS 8.8)
- [CVE-2026-12489](https://cve.now/CVE-2026-12489.md): An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could… (CVSS 6.5)
- [CVE-2026-14818](https://cve.now/CVE-2026-14818.md): A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throu (CVSS 7.2)
- [CVE-2026-8508](https://cve.now/CVE-2026-8508.md): An improper authentication vulnerability in the "social\_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 cou (CVSS 6.5)
- [CVE-2026-6837](https://cve.now/CVE-2026-6837.md): A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4 (CVSS 7.2)
- [CVE-2026-6952](https://cve.now/CVE-2026-6952.md): A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware… (CVSS 7.2)
- [CVE-2026-7273](https://cve.now/CVE-2026-7273.md): A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a (CVSS 8.8, KEV)
- [CVE-2026-3871](https://cve.now/CVE-2026-3871.md): A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 cou (CVSS 6.5)
- [CVE-2026-3870](https://cve.now/CVE-2026-3870.md): A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could (CVSS 6.5)
- [CVE-2026-4795](https://cve.now/CVE-2026-4795.md): A missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.0 (CVSS 6.5)
- [CVE-2026-7287](https://cve.now/CVE-2026-7287.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and fo (CVSS 7.5)
- [CVE-2026-7257](https://cve.now/CVE-2026-7257.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 fir (CVSS 4.4)
- [CVE-2026-7256](https://cve.now/CVE-2026-7256.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 co (CVSS 8.8)
- [CVE-2026-7255](https://cve.now/CVE-2026-7255.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* An improper restriction of excessive authentication attempts vulnerability in the web management interface o (CVSS 6.5)
- [CVE-2026-1460](https://cve.now/CVE-2026-1460.md): A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zyxel DX3301-T0 and EX (CVSS 7.2)
- [CVE-2026-0711](https://cve.now/CVE-2026-0711.md): A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7. (CVSS 6.8)
- [CVE-2026-6058](https://cve.now/CVE-2026-6058.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00 (CVSS 4.5)
- [CVE-2026-1459](https://cve.now/CVE-2026-1459.md): A post-authentication command injection vulnerability in the TR-369 certificate download CGI program of the Zyxel VMG3625-T50B firmware vers (CVSS 7.2)
- [CVE-2025-13943](https://cve.now/CVE-2025-13943.md): A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.5 (CVSS 8.8)
- [CVE-2025-13942](https://cve.now/CVE-2025-13942.md): A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remo (CVSS 9.8)
- [CVE-2025-11848](https://cve.now/CVE-2025-11848.md): A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 (CVSS 4.9)
- [CVE-2025-11847](https://cve.now/CVE-2025-11847.md): A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 (CVSS 4.9)
- [CVE-2025-11846](https://cve.now/CVE-2025-11846.md): A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9 (CVSS 4.9)
- [CVE-2025-11845](https://cve.now/CVE-2025-11845.md): A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50( (CVSS 4.9)
- [CVE-2025-11730](https://cve.now/CVE-2025-11730.md): A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versi (CVSS 7.2)
- [CVE-2025-8693](https://cve.now/CVE-2025-8693.md): A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earli (CVSS 8.8)
- [CVE-2025-6599](https://cve.now/CVE-2025-6599.md): An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could (CVSS 5.3)
- [CVE-2025-9133](https://cve.now/CVE-2025-9133.md): A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from (CVSS 8.1)
- [CVE-2025-8078](https://cve.now/CVE-2025-8078.md): A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmwa (CVSS 7.2)
- [CVE-2025-7673](https://cve.now/CVE-2025-7673.md): A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 (CVSS 9.8)
- [CVE-2025-6265](https://cve.now/CVE-2025-6265.md): A path traversal vulnerability in the file\_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow (CVSS 7.2)
- [CVE-2025-3577](https://cve.now/CVE-2025-3577.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00 (CVSS 4.9)
- [CVE-2025-1732](https://cve.now/CVE-2025-1732.md): An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlie (CVSS 6.7)
- [CVE-2025-1731](https://cve.now/CVE-2025-1731.md): An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 (CVSS 7.8)
- [CVE-2024-12010](https://cve.now/CVE-2024-12010.md): A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5. (CVSS 7.2)
- [CVE-2024-12009](https://cve.now/CVE-2024-12009.md): A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and e (CVSS 7.2)
- [CVE-2024-11253](https://cve.now/CVE-2024-11253.md): A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firm (CVSS 7.2)
- [CVE-2025-0890](https://cve.now/CVE-2025-0890.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version (CVSS 9.8)
- [CVE-2024-40891](https://cve.now/CVE-2024-40891.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel V (CVSS 8.8, KEV)
- [CVE-2024-40890](https://cve.now/CVE-2024-40890.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B (CVSS 8.8, KEV)
- [CVE-2024-12398](https://cve.now/CVE-2024-12398.md): An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) an (CVSS 8.8)
- [CVE-2024-9200](https://cve.now/CVE-2024-9200.md): A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware vers (CVSS 7.2)
- [CVE-2024-9197](https://cve.now/CVE-2024-9197.md): A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions thr (CVSS 4.9)
- [CVE-2024-8748](https://cve.now/CVE-2024-8748.md): A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through (CVSS 7.5)
- [CVE-2024-11667](https://cve.now/CVE-2024-11667.md): A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seri (CVSS 7.5, KEV)
- [CVE-2024-11494](https://cve.now/CVE-2024-11494.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP\_201403 (CVSS 7.5)
- [CVE-2024-8882](https://cve.now/CVE-2024-8882.md): A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an (CVSS 4.5)
- [CVE-2024-8881](https://cve.now/CVE-2024-8881.md): A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and (CVSS 6.8)
- [CVE-2024-9677](https://cve.now/CVE-2024-9677.md): The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier ve (CVSS 5.5)
- [CVE-2024-38269](https://cve.now/CVE-2024-38269.md): An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmwar (CVSS 4.9)
- [CVE-2024-38268](https://cve.now/CVE-2024-38268.md): An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware vers (CVSS 4.9)
- [CVE-2024-38267](https://cve.now/CVE-2024-38267.md): An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware ver (CVSS 4.9)
- [CVE-2024-38266](https://cve.now/CVE-2024-38266.md): An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware v (CVSS 4.9)
- [CVE-2024-6342](https://cve.now/CVE-2024-6342.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AA (CVSS 9.8)
- [CVE-2024-38270](https://cve.now/CVE-2024-38270.md): An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens gen (CVSS 5.3)
- [CVE-2024-7261](https://cve.now/CVE-2024-7261.md): The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4 (CVSS 9.8)
- [CVE-2024-42061](https://cve.now/CVE-2024-42061.md): A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic\_script.cgi" of Zyxel ATP series firmware versions from V4.3 (CVSS 6.1)
- [CVE-2024-42060](https://cve.now/CVE-2024-42060.md): A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmwa (CVSS 7.2)
- [CVE-2024-42059](https://cve.now/CVE-2024-42059.md): A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmwa (CVSS 7.2)
- [CVE-2024-42058](https://cve.now/CVE-2024-42058.md): A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions f (CVSS 7.5)
- [CVE-2024-42057](https://cve.now/CVE-2024-42057.md): A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series f (CVSS 8.1)
- [CVE-2024-7203](https://cve.now/CVE-2024-7203.md): A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series fir (CVSS 7.2)
- [CVE-2024-6343](https://cve.now/CVE-2024-6343.md): A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware (CVSS 4.9)
- [CVE-2024-5412](https://cve.now/CVE-2024-5412.md): A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthen (CVSS 7.5)
- [CVE-2024-8234](https://cve.now/CVE-2024-8234.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the (CVSS 7.5)
- [CVE-2024-1575](https://cve.now/CVE-2024-1575.md): The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authe (CVSS 6.5)
- [CVE-2024-29976](https://cve.now/CVE-2024-29976.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The improper privilege management vulnerability in the command “show\_allsessions” in Zyxel NAS326 firmware v (CVSS 6.5)
- [CVE-2024-29975](https://cve.now/CVE-2024-29975.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versi (CVSS 6.7)
- [CVE-2024-29974](https://cve.now/CVE-2024-29974.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The remote code execution vulnerability in the CGI program “file\_upload-cgi” in Zyxel NAS326 firmware versio (CVSS 9.8)
- [CVE-2024-29973](https://cve.now/CVE-2024-29973.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5 (CVSS 9.8)
- [CVE-2024-29972](https://cve.now/CVE-2024-29972.md): \* UNSUPPORTED WHEN ASSIGNED \* The command injection vulnerability in the CGI program "remote\_help-cgi" in Zyxel NAS326 firmware versions… (CVSS 9.8)
- [CVE-2024-0816](https://cve.now/CVE-2024-0816.md): The buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow an authenticated local attacker to cause den (CVSS 5.5)
- [CVE-2023-37929](https://cve.now/CVE-2023-37929.md): The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remot (CVSS 6.5)
- [CVE-2023-6764](https://cve.now/CVE-2023-6764.md): A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.3 (CVSS 8.1)
- [CVE-2023-6399](https://cve.now/CVE-2023-6399.md): A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4 (CVSS 5.7)
- [CVE-2023-6398](https://cve.now/CVE-2023-6398.md): A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 (CVSS 7.2)
- [CVE-2023-6397](https://cve.now/CVE-2023-6397.md): A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX serie (CVSS 6.5)
- [CVE-2023-5372](https://cve.now/CVE-2023-5372.md): The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versi (CVSS 7.2)
- [CVE-2023-4474](https://cve.now/CVE-2023-4474.md): The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware (CVSS 9.8)
- [CVE-2023-4473](https://cve.now/CVE-2023-4473.md): A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21( (CVSS 9.8)
- [CVE-2023-37928](https://cve.now/CVE-2023-37928.md): A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fi (CVSS 8.8)
- [CVE-2023-37927](https://cve.now/CVE-2023-37927.md): The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware (CVSS 8.8)
- [CVE-2023-35138](https://cve.now/CVE-2023-35138.md): A command injection vulnerability in the “show\_zysync\_server\_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NA (CVSS 9.8)
- [CVE-2023-35137](https://cve.now/CVE-2023-35137.md): An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmw (CVSS 7.5)
- [CVE-2023-5960](https://cve.now/CVE-2023-5960.md): An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and V (CVSS 5.5)
- [CVE-2023-5797](https://cve.now/CVE-2023-5797.md): An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLE (CVSS 5.5)
- [CVE-2023-5650](https://cve.now/CVE-2023-5650.md): An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firm (CVSS 5.5)
- [CVE-2023-4398](https://cve.now/CVE-2023-4398.md): An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware (CVSS 7.5)
- [CVE-2023-4397](https://cve.now/CVE-2023-4397.md): A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W) series (CVSS 4.4)
- [CVE-2023-37926](https://cve.now/CVE-2023-37926.md): A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through (CVSS 5.5)
- [CVE-2023-37925](https://cve.now/CVE-2023-37925.md): An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLE (CVSS 5.5)
- [CVE-2023-35139](https://cve.now/CVE-2023-35139.md): A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series f (CVSS 5.2)
- [CVE-2023-35136](https://cve.now/CVE-2023-35136.md): An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX ser (CVSS 5.5)
- [CVE-2023-5593](https://cve.now/CVE-2023-5593.md): The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticated (CVSS 7.8)
- [CVE-2023-35140](https://cve.now/CVE-2023-35140.md): The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated (CVSS 5.5)
- [CVE-2023-43314](https://cve.now/CVE-2023-43314.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\*The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11\_C0 could allow (CVSS 7.5)
- [CVE-2023-33013](https://cve.now/CVE-2023-33013.md): A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an au (CVSS 8.8)
- [CVE-2023-28768](https://cve.now/CVE-2023-28768.md): Improper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1), and XS1930-10 fir (CVSS 6.5)
- [CVE-2023-34141](https://cve.now/CVE-2023-34141.md): A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Pa (CVSS 8.0)
- [CVE-2023-34140](https://cve.now/CVE-2023-34140.md): A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 (CVSS 6.5)
- [CVE-2023-34139](https://cve.now/CVE-2023-34139.md): A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Pat (CVSS 8.8)
- [CVE-2023-34138](https://cve.now/CVE-2023-34138.md): A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG (CVSS 8.0)
- [CVE-2023-33012](https://cve.now/CVE-2023-33012.md): A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX (CVSS 8.8)
- [CVE-2023-33011](https://cve.now/CVE-2023-33011.md): A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 th (CVSS 8.8)
- [CVE-2023-28767](https://cve.now/CVE-2023-28767.md): The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX serie (CVSS 8.8)
- [CVE-2023-27992](https://cve.now/CVE-2023-27992.md): The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware vers (CVSS 9.8, KEV)
- [CVE-2023-27989](https://cve.now/CVE-2023-27989.md): A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote auth (CVSS 6.5)
- [CVE-2022-45853](https://cve.now/CVE-2022-45853.md): The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI (CVSS 6.7)
- [CVE-2023-27988](https://cve.now/CVE-2023-27988.md): The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authe (CVSS 7.2)
- [CVE-2023-33010](https://cve.now/CVE-2023-33010.md): A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX seri (CVSS 9.8, KEV)
- [CVE-2023-33009](https://cve.now/CVE-2023-33009.md): A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serie (CVSS 9.8, KEV)
- [CVE-2023-22924](https://cve.now/CVE-2023-22924.md): A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated atta (CVSS 4.9)
- [CVE-2023-22923](https://cve.now/CVE-2023-22923.md): A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenti (CVSS 6.5)
- [CVE-2023-22922](https://cve.now/CVE-2023-22922.md): A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated at (CVSS 7.5)
- [CVE-2023-22921](https://cve.now/CVE-2023-22921.md): A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authent (CVSS 7.5)
- [CVE-2023-22919](https://cve.now/CVE-2023-22919.md): The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated a (CVSS 8.8)
- [CVE-2023-28770](https://cve.now/CVE-2023-28770.md): The sensitive information exposure vulnerability in the CGI “Export\_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to (CVSS 7.5)
- [CVE-2023-28769](https://cve.now/CVE-2023-28769.md): The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5. (CVSS 9.8)
- [CVE-2023-28771](https://cve.now/CVE-2023-28771.md): Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5. (CVSS 9.8, KEV)
- [CVE-2023-27991](https://cve.now/CVE-2023-27991.md): The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX (CVSS 8.8)
- [CVE-2023-27990](https://cve.now/CVE-2023-27990.md): The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 (CVSS 4.8)
- [CVE-2023-22918](https://cve.now/CVE-2023-22918.md): A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLE (CVSS 6.5)
- [CVE-2023-22917](https://cve.now/CVE-2023-22917.md): A buffer overflow vulnerability in the “sdwan\_iface\_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series fir (CVSS 7.5)
- [CVE-2023-22916](https://cve.now/CVE-2023-22916.md): The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG F (CVSS 8.1)
- [CVE-2023-22915](https://cve.now/CVE-2023-22915.md): A buffer overflow vulnerability in the “fbwifi\_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FL (CVSS 7.5)
- [CVE-2023-22914](https://cve.now/CVE-2023-22914.md): A path traversal vulnerability in the “account\_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN (CVSS 7.2)
- [CVE-2023-22913](https://cve.now/CVE-2023-22913.md): A post-authentication command injection vulnerability in the “account\_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4 (CVSS 8.1)
- [CVE-2023-22920](https://cve.now/CVE-2023-22920.md): A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconf (CVSS 9.8)
- [CVE-2022-45854](https://cve.now/CVE-2022-45854.md): An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to ca (CVSS 4.3)
- [CVE-2022-45441](https://cve.now/CVE-2022-45441.md): A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker t (CVSS 6.1)
- [CVE-2022-38547](https://cve.now/CVE-2022-38547.md): A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN (CVSS 7.2)
- [CVE-2022-45440](https://cve.now/CVE-2022-45440.md): A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on externa (CVSS 4.4)
- [CVE-2022-45439](https://cve.now/CVE-2022-45439.md): A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. (CVSS 6.5)
- [CVE-2022-43393](https://cve.now/CVE-2022-43393.md): An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70 (CVSS 8.2)
- [CVE-2022-43392](https://cve.now/CVE-2022-43392.md): A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authe (CVSS 6.5)
- [CVE-2022-43391](https://cve.now/CVE-2022-43391.md): A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an (CVSS 6.5)
- [CVE-2022-43390](https://cve.now/CVE-2022-43390.md): A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated a (CVSS 5.4)
- [CVE-2022-43389](https://cve.now/CVE-2022-43389.md): A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an una (CVSS 8.6)
- [CVE-2022-38546](https://cve.now/CVE-2022-38546.md): A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker (CVSS 5.3)
- [CVE-2022-40603](https://cve.now/CVE-2022-40603.md): A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series fir (CVSS 4.7)
- [CVE-2022-40602](https://cve.now/CVE-2022-40602.md): A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an impr (CVSS 9.8)
- [CVE-2022-34746](https://cve.now/CVE-2022-34746.md): An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was foun (CVSS 5.9)
- [CVE-2022-34747](https://cve.now/CVE-2022-34747.md): A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized re (CVSS 9.8)
- [CVE-2022-2030](https://cve.now/CVE-2022-2030.md): A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI pro (CVSS 6.5)
- [CVE-2022-30526](https://cve.now/CVE-2022-30526.md): A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLE (CVSS 7.8)
- [CVE-2022-0823](https://cve.now/CVE-2022-0823.md): An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the passwor (CVSS 6.2)
- [CVE-2022-26532](https://cve.now/CVE-2022-26532.md): A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLE (CVSS 7.8)
- [CVE-2022-0910](https://cve.now/CVE-2022-0910.md): A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware (CVSS 6.5)
- [CVE-2022-0734](https://cve.now/CVE-2022-0734.md): A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG F (CVSS 5.8)
- [CVE-2022-26531](https://cve.now/CVE-2022-26531.md): Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71 (CVSS 6.1)
- [CVE-2022-30525](https://cve.now/CVE-2022-30525.md): A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f (CVSS 9.8, KEV)
- [CVE-2022-26414](https://cve.now/CVE-2022-26414.md): A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, w (CVSS 6.0)
- [CVE-2022-26413](https://cve.now/CVE-2022-26413.md): A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated (CVSS 8.0)
- [CVE-2022-0556](https://cve.now/CVE-2022-0556.md): A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) (CVSS 7.3)
- [CVE-2022-0342](https://cve.now/CVE-2022-0342.md): An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi (CVSS 9.8)
- [CVE-2021-4039](https://cve.now/CVE-2021-4039.md): A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS com (CVSS 9.8)
- [CVE-2021-35036](https://cve.now/CVE-2021-35036.md): A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated at (CVSS 6.5)
- [CVE-2021-4029](https://cve.now/CVE-2021-4029.md): A command injection vulnerability in the CGI program of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary OS comma (CVSS 8.8)
- [CVE-2021-4030](https://cve.now/CVE-2021-4030.md): A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary (CVSS 8.0)
- [CVE-2021-35035](https://cve.now/CVE-2021-35035.md): A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obt (CVSS 4.9)
- [CVE-2021-35034](https://cve.now/CVE-2021-35034.md): An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access th (CVSS 7.4)
- [CVE-2021-35032](https://cve.now/CVE-2021-35032.md): A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbit (CVSS 6.4)
- [CVE-2021-35031](https://cve.now/CVE-2021-35031.md): A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow (CVSS 6.8)
- [CVE-2021-35033](https://cve.now/CVE-2021-35033.md): A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managem (CVSS 7.8)
- [CVE-2021-35028](https://cve.now/CVE-2021-35028.md): A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to ex (CVSS 7.3)
- [CVE-2021-35027](https://cve.now/CVE-2021-35027.md): A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access (CVSS 7.5)
- [CVE-2021-35030](https://cve.now/CVE-2021-35030.md): A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and c (CVSS 3.5)
- [CVE-2021-35029](https://cve.now/CVE-2021-35029.md): An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 (CVSS 9.8)
- [CVE-2020-9054](https://cve.now/CVE-2020-9054.md): ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi (CVSS 9.8, KEV)
- [CVE-2018-1164](https://cve.now/CVE-2018-1164.md): This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router (no CVSS)
- [CVE-2017-3216](https://cve.now/CVE-2017-3216.md): WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zyxel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.