A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
CVE-2023-4474 is a critical OS command injection vulnerability in Zyxel NAS326 and NAS542 firmware versions V5.21(AAZF.14)C0 and V5.21(ABAG.11)C0. It arises from improper neutralization of special elements in the WSGI server, allowing unauthenticated attackers to execute arbitrary OS commands via crafted URLs. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability without requiring authentication or user interaction. Exploitation could lead to full system compromise, data theft, or service disruption. No public exploits are currently known, but the severity demands immediate attention.
CVE-2023-4473 is a critical OS command injection vulnerability in Zyxel NAS326 and NAS542 firmware versions V5.21(AAZF.14)C0 and V5.21(ABAG.11)C0. It allows unauthenticated attackers to execute arbitrary OS commands by sending crafted URLs to the device's web server. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). With a CVSS score of 9.8, it poses a severe risk to confidentiality, integrity, and availability without requiring authentication or user interaction. No public exploits are known yet, but the impact could be devastating if exploited.
An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to access configuration files on an affected device.
Zyxel EMG2926 routers have a command injection vulnerability in the diagnostic nslookup function. This flaw allows attackers to execute arbitrary commands on the device by manipulating parameters such as ping_ip in the diagnostic URI. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
Zyxel P660HN-T1A routers have a command injection vulnerability in the Remote System Log forwarding feature. This flaw is exploitable by unauthenticated users via the remote_host parameter on the ViewLog.asp page. The vulnerability has been exploited in the wild and is considered high severity.
The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.
CVE-2023-33010 is a critical buffer overflow vulnerability in multiple Zyxel firewall and VPN device firmware versions, including ATP, USG FLEX, USG20(W)-VPN, and ZyWALL/USG series. The flaw exists in the ID processing function and allows an unauthenticated attacker to remotely execute code or cause denial-of-service conditions. It affects firmware versions ranging approximately from 4.25 to 5.36 Patch 1, depending on the product line. The vulnerability has a CVSS score of 9.8, indicating high exploitability without authentication or user interaction. Although no known exploits are currently reported in the wild, the potential impact on confidentiality, integrity, and availability is severe. European organizations using Zyxel network security appliances are at risk, especially those in critical infrastructure, government, and enterprises relying on these devices for perimeter defense. Mitigation requires immediate firmware updates once patches are available, network segmentation, and monitoring for anomalous traffic targeting these devices.
CVE-2023-33009 is a critical buffer overflow vulnerability in multiple Zyxel firewall and VPN device firmware versions (4.60 through 5.36 Patch 1). It affects Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG series devices. The flaw exists in the notification function and can be exploited remotely without authentication or user interaction. Successful exploitation can lead to denial-of-service or remote code execution, compromising confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the high CVSS score (9.8) indicates severe risk. European organizations using these Zyxel devices should prioritize patching and implement network-level protections. Countries with significant Zyxel deployments and critical infrastructure reliance on these devices are at higher risk.
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.
CVE-2022-30525 is a command injection vulnerability affecting certain Zyxel firewall devices. The flaw exists in a CGI program, allowing attackers to modify files and execute operating system commands on vulnerable devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Multiple Zyxel network-attached storage (NAS) devices have a pre-authentication OS command injection vulnerability (CVE-2020-9054) that allows remote unauthenticated attackers to execute arbitrary code. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) have a vulnerability involving hard-coded credentials in an undocumented account named "zyfwp" with an unchangeable password. This vulnerability allows unauthorized access due to the presence of fixed credentials that cannot be changed by users.
