ZyWALL/USG series firmware vulnerabilities

4 known vulnerabilities in ZyWALL/USG series firmware from Zyxel. 4 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Zyxel Multiple Firewalls Buffer Overflow Exploited

  CVE-2023-33010May 24, 2023ZyxelEPSS 29%

  A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls Buffer Overflow Exploited

  CVE-2023-33009May 24, 2023ZyxelEPSS 28.1%

  A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN

• 9.8 Critical severity

  Zyxel Multiple Firewalls OS Command Injection Exploited

  CVE-2023-28771Apr 25, 2023ZyxelEPSS 99.3%

  Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could

• 7.2 High severity

  ZyWALL/USG series firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-38547Feb 7, 2023ZyxelEPSS 2.83%

  A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmwar