Zyxel vulnerabilities, page 5
327 vulnerabilities
Known vulnerabilities in Zyxel products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 572 products.
HighCVE-2020-20183zyxel · p1302-t10_v3_firmwarezyxel p1302-t10_v3_firmwareInsecure direct object reference vulnerability in Zyxel’s P1302-T10 v3 with firmware version 2.00(ABBX.3) and earlier allows attackers to gain privileges and access certain admin pages.EPSS1.01%CriticalCVE-2020-9054zyxel · atp100_firmware +34 moreZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgiMultiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2KEVEPSS99.99%HighCVE-2020-14461zyxel · wap6806_firmwarezyxel wap6806_firmwareZyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.EPSS9.54%CriticalCVE-2020-25014zyxel · access_points_firmware +1 morezyxel access_points_firmwareA stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.EPSS4.44%CriticalCVE-2020-29299zyxel · nsg_firmware +3 morezyxel nsg_firmwareCertain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.EPSS2.37%CriticalCVE-2020-29583zyxel · atp100_firmware +29 morezyxel atp100_firmwareFirmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.KEVEPSS90.16%CriticalCVE-2020-24355zyxel · vmg5313-b30b_firmwarezyxel vmg5313-b30b_firmwareZyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.EPSS2.18%HighCVE-2020-24354zyxel · vmg5313-b30b_firmwarezyxel vmg5313-b30b_firmwareZyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection.EPSS1.30%CriticalCVE-2020-28899zyxel · lte4506-m606_firmware +2 morezyxel lte4506-m606_firmwareThe Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network.EPSS1.69%HighCVE-2020-15335zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.EPSS0.93%MediumCVE-2020-15318zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.EPSS1.00%MediumCVE-2020-15328zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.EPSS0.85%MediumCVE-2020-15325zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.EPSS0.57%MediumCVE-2020-15319zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.EPSS1.00%CriticalCVE-2020-15321zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.EPSS1.25%MediumCVE-2020-15345zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.EPSS0.57%MediumCVE-2020-15337zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.EPSS0.79%CriticalCVE-2020-15324zyxel · cloud_cnm_secumanagerzyxel cloud_cnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.EPSS1.25%CriticalCVE-2020-15320zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.EPSS1.25%MediumCVE-2020-15339zyxel · cloudcnm_secumanagerzyxel cloudcnm_secumanagerZyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.EPSS0.71%