Zyxel Usg Flex 100H Firmware vulnerabilities
4 known vulnerabilities affecting zyxel/usg_flex_100h_firmware.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2023-6398HIGHCVSS 7.2≥ 4.50, < 5.37v5.372024-02-20
CVE-2023-6398 [HIGH] CWE-78 CVE-2023-6398: A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1,
nvd
CVE-2023-6764HIGHCVSS 8.1≥ 4.50, < 5.37v5.372024-02-20
CVE-2023-6764 [HIGH] CWE-134 CVE-2023-6764:
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could
nvd
CVE-2023-6399MEDIUMCVSS 6.5≥ 5.10, < 5.37v5.372024-02-20
CVE-2023-6399 [MEDIUM] CWE-134 CVE-2023-6399: A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1,
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1
nvd
CVE-2023-6397MEDIUMCVSS 5.3≥ 4.50, < 5.37v5.372024-02-20
CVE-2023-6397 [MEDIUM] CWE-476 CVE-2023-6397:
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-M
nvd