Usg Flex 700h Firmware vulnerabilities

8 known vulnerabilities in Usg Flex 700h Firmware from Zyxel. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

8vulnerabilities

0critical

8high

0exploited

7.5average CVSS score

Latest first

7.8 High severity
USG FLEX H series uOS firmware: Insufficiently Protected Credentials
CVE-2024-9677Oct 22, 2024Zyxel
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of
7.2 High severity
ATP series firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-7203Sep 3, 2024ZyxelEPSS 1.34%
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute s
7.2 High severity
ATP series firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-42060Sep 3, 2024ZyxelEPSS 1.34%
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN
7.2 High severity
ATP series firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-42059Sep 3, 2024ZyxelEPSS 1.34%
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN
7.5 High severity
ATP series firmware: NULL Pointer Dereference
CVE-2024-42058Sep 3, 2024Zyxel
A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmw
8.1 High severity
ATP series firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-42057Sep 3, 2024ZyxelEPSS 1.32%
A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W
8.1 High severity
ATP series firmware: Use of Externally-Controlled Format String
CVE-2023-6764Feb 20, 2024Zyxel
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 throu
7.2 High severity
ATP series firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2023-6398Feb 20, 2024ZyxelEPSS 1.33%
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from