Zyxel
Zyxel USG Flex 50 Firmware: vulnerabilidades y CVE
Zyxel USG Flex 50 Firmware tiene 23 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 3 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses0
Críticas3
Explotadas activamente3
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-33009 | Crítica (9.8) | 28% | ⚠ Explotación activa | 24 may 2023 | A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions… |
| CVE-2023-33010 | Crítica (9.8) | 29% | ⚠ Explotación activa | 24 may 2023 | A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware… |
| CVE-2023-28771 | Crítica (9.8) | 99% | ⚠ Explotación activa | 25 abr 2023 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-6764 | Alta (8.1) | 0.89% | — | 20 feb 2024 | A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W)… |
| CVE-2023-6399 | Media (6.5) | 0.65% | — | 20 feb 2024 | A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16… |
| CVE-2023-6398 | Alta (7.2) | 1.3% | — | 20 feb 2024 | A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG… |
| CVE-2023-6397 | Media (5.3) | 0.30% | — | 20 feb 2024 | A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to… |
| CVE-2023-34141 | Alta (8) | 0.68% | — | 17 jul 2023 | A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX… |
| CVE-2023-34140 | Media (6.5) | 0.30% | — | 17 jul 2023 | A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 4.16 through 5.36… |
| CVE-2023-34139 | Alta (8.8) | 0.76% | — | 17 jul 2023 | A command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and VPN series firmware versions 4.20 through 5.36 Patch 2, could allow an… |
| CVE-2023-34138 | Alta (8) | 0.68% | — | 17 jul 2023 | A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60 through 5.36 Patch 2, USG FLEX 50(W) series… |
| CVE-2023-33012 | Alta (8.8) | 9.9% | — | 17 jul 2023 | A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series… |
| CVE-2023-33011 | Alta (8.8) | 0.34% | — | 17 jul 2023 | A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36… |
| CVE-2023-28767 | Alta (8.8) | 0.40% | — | 17 jul 2023 | The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50(W) series firmware versions… |
| CVE-2023-33010 | Crítica (9.8) | 29% | ⚠ Explotación activa | 24 may 2023 | A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware… |
| CVE-2023-33009 | Crítica (9.8) | 28% | ⚠ Explotación activa | 24 may 2023 | A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions… |
| CVE-2023-28771 | Crítica (9.8) | 99% | ⚠ Explotación activa | 25 abr 2023 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series… |
| CVE-2023-27991 | Alta (8.8) | 1.5% | — | 24 abr 2023 | The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions… |
| CVE-2023-27990 | Media (4.8) | 0.34% | — | 24 abr 2023 | The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN… |
| CVE-2023-22918 | Media (6.5) | 0.77% | — | 24 abr 2023 | A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions… |
| CVE-2023-22917 | Alta (7.5) | 0.88% | — | 24 abr 2023 | A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through… |
| CVE-2023-22916 | Alta (8.1) | 0.69% | — | 24 abr 2023 | The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions… |
| CVE-2023-22915 | Alta (7.5) | 1.1% | — | 24 abr 2023 | A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions… |
| CVE-2023-22914 | Alta (7.2) | 1.0% | — | 24 abr 2023 | A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote… |
| CVE-2023-22913 | Alta (8.1) | 1.3% | — | 24 abr 2023 | A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which… |
| CVE-2022-38547 | Alta (7.2) | 2.8% | — | 7 feb 2023 | A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Zyxel
Gs1900-10hp Firmware · 35Cloudcnm Secumanager · 35USG Flex 100w Firmware · 34USG Flex 700 Firmware · 34USG Flex 500 Firmware · 34USG Flex 200 Firmware · 34USG Flex 100 Firmware · 30Emg3525-t50b Firmware · 28Vmg8623-t50b Firmware · 28Emg5523-t50b Firmware · 28USG Flex 50W Firmware · 26Atp500 Firmware · 25