CVE-2020-29299: zyxel nsg_firmware Command Injection
Vulnerability summary
CVE-2020-29299 is a high (CVSS 9.0) Command Injection vulnerability in zyxel nsg_firmware. EPSS estimates a 2.37% chance of exploitation in the next 30 days, higher than 83.6% of scored vulnerabilities.
Timeline
- 27-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.37%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
+0.03 pp
From 2.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Zyxel4 products
- nsg_firmware< 1.33 | 1.33 | 1.33:patch1
- usg_flex_firmwarena
- vpn_orchestrator< 10.03
- zld< 4.39 | < 4.55
1 vendor · 4 products
References
2 links- www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtmlX Refsource MISCVendor Advisory