{"schemaVersion":3,"id":"CVE-2022-26531","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.","dates":{"published":"2022-05-24T00:00:00.000Z","modified":"2024-08-03T05:03:33.155Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.6,"severity":"medium","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.06175,"percentile":0.93429,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.5019999999999997,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.05673},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.06175,"percentile":0.93429}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05673,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06175,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.06175,"percentile":0.93429}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"zyxel","product":"atp series firmware","name":"ATP series firmware","label":"atp series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.32 through 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.32 through 5.21","eol":null,"hubHref":"/vendor/zyxel/atp_series_firmware"},{"vendor":"zyxel","product":"atp100_firmware","name":"atp100 firmware","label":"atp100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp100"},{"vendor":"zyxel","product":"atp100w_firmware","name":"atp100w firmware","label":"atp100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp100w"},{"vendor":"zyxel","product":"atp200_firmware","name":"atp200 firmware","label":"atp200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp200"},{"vendor":"zyxel","product":"atp500_firmware","name":"atp500 firmware","label":"atp500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp500"},{"vendor":"zyxel","product":"atp700_firmware","name":"atp700 firmware","label":"atp700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp700"},{"vendor":"zyxel","product":"atp800_firmware","name":"atp800 firmware","label":"atp800_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.32, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.32, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/atp800"},{"vendor":"zyxel","product":"nap203_firmware","name":"nap203 firmware","label":"nap203_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abfa.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abfa.7\\)","eol":null,"hubHref":"/vendor/zyxel/nap203"},{"vendor":"zyxel","product":"nap203 firmware","name":"NAP203 firmware","label":"nap203 firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25(ABFA.7)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25(ABFA.7)","eol":null,"hubHref":"/vendor/zyxel/nap203_firmware"},{"vendor":"zyxel","product":"nap303_firmware","name":"nap303 firmware","label":"nap303_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abex.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abex.7\\)","eol":null,"hubHref":"/vendor/zyxel/nap303"},{"vendor":"zyxel","product":"nap353_firmware","name":"nap353 firmware","label":"nap353_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abey.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abey.7\\)","eol":null,"hubHref":"/vendor/zyxel/nap353"},{"vendor":"zyxel","product":"nsg series firmware","name":"NSG series firmware","label":"nsg series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.00 through 1.33 Patch 4","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.00 through 1.33 Patch 4","eol":null,"hubHref":"/vendor/zyxel/nsg_series_firmware"},{"vendor":"zyxel","product":"nsg100_firmware","name":"nsg100 firmware","label":"nsg100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 1.00, < 1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch1","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch2","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch3","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.00, < 1.33 | 1.33 | 1.33:patch1 | 1.33:patch2 | 1.33:patch3 | 1.33:patch4","eol":null,"hubHref":"/vendor/zyxel/nsg100"},{"vendor":"zyxel","product":"nsg300_firmware","name":"nsg300 firmware","label":"nsg300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 1.00, < 1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch1","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch2","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch3","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.00, < 1.33 | 1.33 | 1.33:patch1 | 1.33:patch2 | 1.33:patch3 | 1.33:patch4","eol":null,"hubHref":"/vendor/zyxel/nsg300"},{"vendor":"zyxel","product":"nsg50_firmware","name":"nsg50 firmware","label":"nsg50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 1.00, < 1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch1","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch2","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch3","noFixRecorded":false,"fixedIn":null},{"text":"1.33:patch4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.00, < 1.33 | 1.33 | 1.33:patch1 | 1.33:patch2 | 1.33:patch3 | 1.33:patch4","eol":null,"hubHref":"/vendor/zyxel/nsg50"},{"vendor":"zyxel","product":"nwa110ax_firmware","name":"nwa110ax firmware","label":"nwa110ax_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abtg.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abtg.2\\)","eol":null,"hubHref":"/vendor/zyxel/nwa110ax"},{"vendor":"zyxel","product":"nwa1123-ac-hd_firmware","name":"nwa1123-ac-hd firmware","label":"nwa1123-ac-hd_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abin.6\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abin.6\\)","eol":null,"hubHref":"/vendor/zyxel/nwa1123-ac-hd"},{"vendor":"zyxel","product":"nwa1123-ac-pro_firmware","name":"nwa1123-ac-pro firmware","label":"nwa1123-ac-pro_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abhd.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abhd.7\\)","eol":null,"hubHref":"/vendor/zyxel/nwa1123-ac-pro"},{"vendor":"zyxel","product":"nwa1123acv3_firmware","name":"nwa1123acv3 firmware","label":"nwa1123acv3_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abvt.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abvt.2\\)","eol":null,"hubHref":"/vendor/zyxel/nwa1123acv3"},{"vendor":"zyxel","product":"nwa1302-ac_firmware","name":"nwa1302-ac firmware","label":"nwa1302-ac_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abku.6\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abku.6\\)","eol":null,"hubHref":"/vendor/zyxel/nwa1302-ac"},{"vendor":"zyxel","product":"nwa210ax_firmware","name":"nwa210ax firmware","label":"nwa210ax_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abtd.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abtd.2\\)","eol":null,"hubHref":"/vendor/zyxel/nwa210ax"},{"vendor":"zyxel","product":"nwa50ax_firmware","name":"nwa50ax firmware","label":"nwa50ax_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abyw.5\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abyw.5\\)","eol":null,"hubHref":"/vendor/zyxel/nwa50ax"},{"vendor":"zyxel","product":"nwa50ax firmware","name":"NWA50AX firmware","label":"nwa50ax firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25(ABYW.5)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25(ABYW.5)","eol":null,"hubHref":"/vendor/zyxel/nwa50ax_firmware"},{"vendor":"zyxel","product":"nwa5123-ac-hd_firmware","name":"nwa5123-ac-hd firmware","label":"nwa5123-ac-hd_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abim.6\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abim.6\\)","eol":null,"hubHref":"/vendor/zyxel/nwa5123-ac-hd"},{"vendor":"zyxel","product":"nwa55axe_firmware","name":"nwa55axe firmware","label":"nwa55axe_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abzl.5\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abzl.5\\)","eol":null,"hubHref":"/vendor/zyxel/nwa55axe"},{"vendor":"zyxel","product":"nwa90ax_firmware","name":"nwa90ax firmware","label":"nwa90ax_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.27\\(accv.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.27\\(accv.2\\)","eol":null,"hubHref":"/vendor/zyxel/nwa90ax"},{"vendor":"zyxel","product":"nxc2500_firmware","name":"nxc2500 firmware","label":"nxc2500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.10\\(aaig.3\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.10\\(aaig.3\\)","eol":null,"hubHref":"/vendor/zyxel/nxc2500"},{"vendor":"zyxel","product":"nxc2500 firmware","name":"NXC2500 firmware","label":"nxc2500 firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.10(AAIG.3)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.10(AAIG.3)","eol":null,"hubHref":"/vendor/zyxel/nxc2500_firmware"},{"vendor":"zyxel","product":"nxc5500_firmware","name":"nxc5500 firmware","label":"nxc5500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.10\\(aaos.3\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.10\\(aaos.3\\)","eol":null,"hubHref":"/vendor/zyxel/nxc5500"},{"vendor":"zyxel","product":"usg_110_firmware","name":"usg 110 firmware","label":"usg_110_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_110"},{"vendor":"zyxel","product":"usg_1100_firmware","name":"usg 1100 firmware","label":"usg_1100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_1100"},{"vendor":"zyxel","product":"usg_1900_firmware","name":"usg 1900 firmware","label":"usg_1900_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_1900"},{"vendor":"zyxel","product":"usg_20w_firmware","name":"usg 20w firmware","label":"usg_20w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_20w"},{"vendor":"zyxel","product":"usg_20w-vpn_firmware","name":"usg 20w-vpn firmware","label":"usg_20w-vpn_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_20w-vpn"},{"vendor":"zyxel","product":"usg_2200-vpn_firmware","name":"usg 2200-vpn firmware","label":"usg_2200-vpn_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_2200-vpn"},{"vendor":"zyxel","product":"usg_310_firmware","name":"usg 310 firmware","label":"usg_310_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_310"},{"vendor":"zyxel","product":"usg_40_firmware","name":"usg 40 firmware","label":"usg_40_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_40"},{"vendor":"zyxel","product":"usg_40w_firmware","name":"usg 40w firmware","label":"usg_40w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_40w"},{"vendor":"zyxel","product":"usg_60_firmware","name":"usg 60 firmware","label":"usg_60_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_60"},{"vendor":"zyxel","product":"usg_60w_firmware","name":"usg 60w firmware","label":"usg_60w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg_60w"},{"vendor":"zyxel","product":"usg_flex_100_firmware","name":"usg flex 100 firmware","label":"usg_flex_100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.50, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.50, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100"},{"vendor":"zyxel","product":"usg_flex_100w_firmware","name":"usg flex 100w firmware","label":"usg_flex_100w_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.50, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.50, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_100w"},{"vendor":"zyxel","product":"usg_flex_200_firmware","name":"usg flex 200 firmware","label":"usg_flex_200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.50, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.50, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_200"},{"vendor":"zyxel","product":"usg_flex_500_firmware","name":"usg flex 500 firmware","label":"usg_flex_500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.50, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.50, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_500"},{"vendor":"zyxel","product":"usg_flex_700_firmware","name":"usg flex 700 firmware","label":"usg_flex_700_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.50, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.50, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_700"},{"vendor":"zyxel","product":"usg flex series firmware","name":"USG FLEX series firmware","label":"usg flex series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.50 through 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.50 through 5.21","eol":null,"hubHref":"/vendor/zyxel/usg_flex_series_firmware"},{"vendor":"zyxel","product":"usg20_firmware","name":"usg20 firmware","label":"usg20_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg20"},{"vendor":"zyxel","product":"usg200_firmware","name":"usg200 firmware","label":"usg200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg200"},{"vendor":"zyxel","product":"usg210_firmware","name":"usg210 firmware","label":"usg210_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg210"},{"vendor":"zyxel","product":"usg2200_firmware","name":"usg2200 firmware","label":"usg2200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg2200"},{"vendor":"zyxel","product":"usg300_firmware","name":"usg300 firmware","label":"usg300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg300"},{"vendor":"zyxel","product":"usg310_firmware","name":"usg310 firmware","label":"usg310_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.09, ≤ 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.09, ≤ 4.71","eol":null,"hubHref":"/vendor/zyxel/usg310"},{"vendor":"zyxel","product":"usg/zywall series firmware","name":"USG/ZyWALL series firmware","label":"usg/zywall series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.09 through 4.71","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.09 through 4.71","eol":null,"hubHref":"/vendor/zyxel/usgzywall_series_firmware"},{"vendor":"zyxel","product":"vpn series firmware","name":"VPN series firmware","label":"vpn series firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.30 through 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.30 through 5.21","eol":null,"hubHref":"/vendor/zyxel/vpn_series_firmware"},{"vendor":"zyxel","product":"vpn100_firmware","name":"vpn100 firmware","label":"vpn100_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.30, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.30, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/vpn100"},{"vendor":"zyxel","product":"vpn1000_firmware","name":"vpn1000 firmware","label":"vpn1000_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.30, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.30, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/vpn1000"},{"vendor":"zyxel","product":"vpn300_firmware","name":"vpn300 firmware","label":"vpn300_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.30, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.30, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/vpn300"},{"vendor":"zyxel","product":"vpn50_firmware","name":"vpn50 firmware","label":"vpn50_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 4.30, ≤ 5.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.30, ≤ 5.21","eol":null,"hubHref":"/vendor/zyxel/vpn50"},{"vendor":"zyxel","product":"wac500_firmware","name":"wac500 firmware","label":"wac500_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abvs.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abvs.2\\)","eol":null,"hubHref":"/vendor/zyxel/wac500"},{"vendor":"zyxel","product":"wac500 firmware","name":"WAC500 firmware","label":"wac500 firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30(ABVS.2)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30(ABVS.2)","eol":null,"hubHref":"/vendor/zyxel/wac500_firmware"},{"vendor":"zyxel","product":"wac500h_firmware","name":"wac500h firmware","label":"wac500h_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abwa.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abwa.2\\)","eol":null,"hubHref":"/vendor/zyxel/wac500h"},{"vendor":"zyxel","product":"wac5302d-s_firmware","name":"wac5302d-s firmware","label":"wac5302d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.10\\(abfh.10\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.10\\(abfh.10\\)","eol":null,"hubHref":"/vendor/zyxel/wac5302d-s"},{"vendor":"zyxel","product":"wac5302d-sv2_firmware","name":"wac5302d-sv2 firmware","label":"wac5302d-sv2_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abvz.6\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abvz.6\\)","eol":null,"hubHref":"/vendor/zyxel/wac5302d-sv2"},{"vendor":"zyxel","product":"wac6103d-i_firmware","name":"wac6103d-i firmware","label":"wac6103d-i_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(aaxh.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(aaxh.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6103d-i"},{"vendor":"zyxel","product":"wac6303d-s_firmware","name":"wac6303d-s firmware","label":"wac6303d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abgl.6\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abgl.6\\)","eol":null,"hubHref":"/vendor/zyxel/wac6303d-s"},{"vendor":"zyxel","product":"wac6502d-e_firmware","name":"wac6502d-e firmware","label":"wac6502d-e_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(aasd.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(aasd.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6502d-e"},{"vendor":"zyxel","product":"wac6502d-s_firmware","name":"wac6502d-s firmware","label":"wac6502d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(aase.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(aase.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6502d-s"},{"vendor":"zyxel","product":"wac6503d-s_firmware","name":"wac6503d-s firmware","label":"wac6503d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(aasf.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(aasf.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6503d-s"},{"vendor":"zyxel","product":"wac6552d-s_firmware","name":"wac6552d-s firmware","label":"wac6552d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(abio.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(abio.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6552d-s"},{"vendor":"zyxel","product":"wac6553d-s_firmware","name":"wac6553d-s firmware","label":"wac6553d-s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.25\\(aasg.7\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.25\\(aasg.7\\)","eol":null,"hubHref":"/vendor/zyxel/wac6553d-s"},{"vendor":"zyxel","product":"wax510d_firmware","name":"wax510d firmware","label":"wax510d_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abtf.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abtf.2\\)","eol":null,"hubHref":"/vendor/zyxel/wax510d"},{"vendor":"zyxel","product":"wax510d firmware","name":"WAX510D firmware","label":"wax510d firmware","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30(ABTF.2)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30(ABTF.2)","eol":null,"hubHref":"/vendor/zyxel/wax510d_firmware"},{"vendor":"zyxel","product":"wax610d_firmware","name":"wax610d firmware","label":"wax610d_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abte.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abte.2\\)","eol":null,"hubHref":"/vendor/zyxel/wax610d"},{"vendor":"zyxel","product":"wax630s_firmware","name":"wax630s firmware","label":"wax630s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abzd.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abzd.2\\)","eol":null,"hubHref":"/vendor/zyxel/wax630s"},{"vendor":"zyxel","product":"wax650s_firmware","name":"wax650s firmware","label":"wax650s_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.30\\(abrm.2\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.30\\(abrm.2\\)","eol":null,"hubHref":"/vendor/zyxel/wax650s"}],"affectedCount":75,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml","label":"www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml","hostname":"www.zyxel.com","tags":["Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Jun/15","label":"seclists.org/fulldisclosure/2022/Jun/15","hostname":"seclists.org","tags":["Mailing List"]},{"url":"http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html","label":"packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html","hostname":"packetstormsecurity.com","tags":[]},{"url":"http://packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html","label":"packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html","hostname":"packetstormsecurity.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-05-24T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T05:03:33.155Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:44:01.039Z","stale":false,"partial":false}}