Zyxel Usg Flex 50W Firmware vulnerabilities
26 known vulnerabilities affecting zyxel/usg_flex_50w_firmware.
Total CVEs
26
CISA KEV
4
actively exploited
Public exploits
4
Exploited in wild
4
Severity breakdown
CRITICAL4HIGH15MEDIUM7
Vulnerabilities
Page 2 of 2
CVE-2022-2030P3MEDIUMCVSS 6.5≥ 4.20, ≤ 5.302022-07-19
CVE-2022-2030 [MEDIUM] CWE-22 CVE-2022-2030: A directory traversal vulnerability caused by specific character sequences within an improperly sani
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.
nvd
CVE-2023-6399P3MEDIUMCVSS 6.5≥ 5.10, < 5.37v5.372024-02-20
CVE-2023-6399 [MEDIUM] CWE-134 CVE-2023-6399: A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1,
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1
nvd
CVE-2023-34140P4MEDIUMCVSS 6.5≥ 4.50, < 5.372023-07-17
CVE-2023-34140 [MEDIUM] CWE-120 CVE-2023-34140: A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2,
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 4.16 through 5.36 Patch 2, VPN series firmware versions 4.30 through 5.36 Patch 2, N
nvd
CVE-2022-40603P4MEDIUMCVSS 6.1≥ 4.50, ≤ 5.312022-12-06
CVE-2022-40603 [MEDIUM] CWE-79 CVE-2022-40603: A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware ve
A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL
nvd
CVE-2023-6397P4MEDIUMCVSS 5.3≥ 4.50, < 5.37v5.372024-02-20
CVE-2023-6397 [MEDIUM] CWE-476 CVE-2023-6397: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feat
nvd
CVE-2023-27990P4MEDIUMCVSS 4.8≥ 4.16, < 5.362023-04-24
CVE-2023-27990 [MEDIUM] CWE-79 CVE-2023-27990: The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35
The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker
nvd
← Previous2 / 2