Zyxel vulnerabilities, page 2
327 vulnerabilities
Known vulnerabilities in Zyxel products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 572 products.
HighCVE-2021-35028zyxel · zywall_vpn2s_firmware +1 morezyxel zywall_vpn2s_firmwareA command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.EPSS0.30%MediumCVE-2021-35030zyxel · gs1900-10hp_firmware +12 morezyxel gs1900-10hp_firmwareA vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.EPSS0.27%CriticalCVE-2021-35034zyxel · nbg6604_firmware +1 morezyxel nbg6604_firmwareAn insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.EPSS1.08%MediumCVE-2021-35036zyxel · ax7501-b0_firmware +31 morezyxel ax7501-b0_firmwareA cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain sensitive information from the configuration file.EPSS0.49%HighCVE-2021-35032zyxel · gs1900 series firmware +12 morezyxel gs1900 series firmwareA vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call.EPSS0.22%CriticalCVE-2021-35029zyxel · atp series firmware +40 morezyxel atp series firmwareAn authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.EPSS2.25%HighCVE-2021-35033zyxel · nbg6818_firmware +11 morezyxel nbg6818_firmwareA vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the device, if the local attacker dismantles the device and uses a USB-to-UART cable to connect the device, or if the remote assistance feature had been enabled by an authenticated user.EPSS0.41%HighCVE-2015-0718cisco · nx-os +6 morecisco nx-osCisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session, aka Bug ID CSCub70579.EPSS3.94%CriticalCVE-2015-7283zyxel · nbg-418n_firmwarezyxel nbg-418n_firmwareThe web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.EPSS3.72%MediumCVE-2015-7256zyxel · c1000z_firmware +24 morezyxel c1000z_firmwareZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A, VMG1312-B30A, VMG1312-B30B, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A, VMG8924-B30A, and VSG1435-B101 DSL CPEs; PMG5318-B20A GPONs; SBG3300-N000, SBG3300-NB00, and SBG3500-N000 small business gateways; GS1900-8 and GS1900-24 switches; and C1000Z, Q1000, FR1000Z, and P8702N project models use non-unique X.509 certificates and SSH host keys.EPSS0.79%HighCVE-2015-7284zyxel · nbg-418n_firmwarezyxel nbg-418n_firmwareCross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.EPSS1.10%HighCVE-2015-5990zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareCross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attackers to hijack the authentication of arbitrary users.EPSS0.62%HighCVE-2015-5987zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareBelkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.EPSS1.34%CriticalCVE-2015-5988zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareThe web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.EPSS2.69%CriticalCVE-2015-5989zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareBelkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.EPSS2.82%HighCVE-2015-6019zyxel · pmg5318-b20a_firmwarezyxel pmg5318-b20a_firmwareThe management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.EPSS2.98%HighCVE-2015-6020zyxel · pmg5318-b20a_firmwarezyxel pmg5318-b20a_firmwareZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account.EPSS2.21%HighCVE-2015-6260zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareCisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.EPSS2.35%HighCVE-2015-6398zyxel · gs1900-10hp_firmwarezyxel gs1900-10hp_firmwareCisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (device reload) via an IPv4 ICMP packet with the IP Record Route option, aka Bug ID CSCuq57512.EPSS1.93%CriticalCVE-2015-6018zyxel · pmg5318-b20a_firmwarezyxel pmg5318-b20a_firmwareThe diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.EPSS20.78%