Zld vulnerabilities

9 known vulnerabilities in Zld from Zyxel. 9 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  ATP series firmware: Missing Authorization

  CVE-2025-9133Oct 21, 2025ZyxelEPSS 5.81%

  A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-8078Oct 21, 2025ZyxelEPSS 1.45%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls Path Traversal Exploited

  CVE-2024-11667Nov 27, 2024ZyxelEPSS 2.95%

  A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-7203Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute s

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42060Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN

• 7.2 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42059Sep 3, 2024ZyxelEPSS 1.34%

  A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN

• 7.5 High severity

  ATP series firmware: NULL Pointer Dereference

  CVE-2024-42058Sep 3, 2024Zyxel

  A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmw

• 8.1 High severity

  ATP series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-42057Sep 3, 2024ZyxelEPSS 1.32%

  A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W

• 7.5 High severity

  ATP series firmware: Integer Overflow or Wraparound

  CVE-2023-4398Nov 28, 2023Zyxel

  An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions