USG FLEX series firmware vulnerabilities

32 known vulnerabilities in USG FLEX series firmware from Zyxel. 32 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  ATP series firmware: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-14818Aug 4, 2026Zyxel

  A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series firmware ver

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-11730Feb 5, 2026ZyxelEPSS 1.43%

  A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX series firmware versions from V5.35 through V5.41, USG FLEX 50(W) series firmware

• 8.1 High severity

  ATP series firmware: Missing Authorization

  CVE-2025-9133Oct 21, 2025ZyxelEPSS 5.81%

  A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-8078Oct 21, 2025ZyxelEPSS 1.45%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls Path Traversal Exploited

  CVE-2024-11667Nov 27, 2024ZyxelEPSS 2.95%

  A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-7203Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute s

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42060Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42059Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN

• 7.5 High severity

  ATP series firmware: NULL Pointer Dereference

  CVE-2024-42058Sep 3, 2024Zyxel

  A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmw

• 8.1 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42057Sep 3, 2024ZyxelEPSS 1.32%

  A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W

• 8.1 High severity

  ATP series firmware: Use of Externally-Controlled Format String

  CVE-2023-6764Feb 20, 2024Zyxel

  A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 throu

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-6398Feb 20, 2024ZyxelEPSS 1.33%

  A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from

• 7.5 High severity

  ATP series firmware: Integer Overflow or Wraparound

  CVE-2023-4398Nov 28, 2023Zyxel

  An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions

• 8.0 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-34141Jul 17, 2023Zyxel

  A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.00 through

• 8.8 High severity

  USG FLEX series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-34139Jul 17, 2023Zyxel

  A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to e

• 8.0 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-34138Jul 17, 2023Zyxel

  A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.60 through 5.36 Patc

• 8.8 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-33012Jul 17, 2023ZyxelEPSS 9.88%

  A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, U

• 8.8 High severity

  ATP series firmware: Use of Externally-Controlled Format String

  CVE-2023-33011Jul 17, 2023Zyxel

  A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware vers

• 8.8 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-28767Jul 17, 2023Zyxel

  The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions 5.10 through 5.36, USG20(W)-VPN series fi

• 9.8 Critical severity

  Zyxel Multiple Firewalls Buffer Overflow Exploited

  CVE-2023-33010May 24, 2023ZyxelEPSS 29%

  A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls Buffer Overflow Exploited

  CVE-2023-33009May 24, 2023ZyxelEPSS 28.1%

  A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls OS Command Injection Exploited

  CVE-2023-28771Apr 25, 2023ZyxelEPSS 99.3%

  Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could

• 8.8 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-27991Apr 24, 2023ZyxelEPSS 1.45%

  The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware v

• 7.5 High severity

  ATP series firmware: Buffer Copy without Checking Size of Input

  CVE-2023-22917Apr 24, 2023Zyxel

  A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.1

• 8.1 High severity

  The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX…

  CVE-2023-22916Apr 24, 2023Zyxel

  The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware

• 7.5 High severity

  USG FLEX series firmware: Buffer Copy without Checking Size of Input

  CVE-2023-22915Apr 24, 2023ZyxelEPSS 1.05%

  A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware

• 7.2 High severity

  USG FLEX series firmware: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-22914Apr 24, 2023ZyxelEPSS 1.03%

  A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privile

• 8.1 High severity

  USG FLEX series firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2023-22913Apr 24, 2023ZyxelEPSS 1.29%

  A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker

• 7.2 High severity

  ZyWALL/USG series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-38547Feb 7, 2023ZyxelEPSS 2.83%

  A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmwar

• 7.8 High severity

  USG/ZyWALL series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26532May 24, 2022ZyxelEPSS 4.79%

  A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versio

• 7.8 High severity

  Multiple improper input validation flaws were identified in some CLI commands of Zyxel…

  CVE-2022-26531May 24, 2022ZyxelEPSS 6.37%

  Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmwa

• 9.8 Critical severity

  USG/ZyWALL series firmware: Improper Authentication

  CVE-2022-0342Mar 28, 2022ZyxelEPSS 95.1%

  An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 thr