Search criteria

15 vulnerabilities found for uos by zyxel

FKIE_CVE-2025-1732

Vulnerability from fkie_nvd - Published: 2025-04-22 03:15 - Updated: 2025-10-30 17:56
Summary
An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device.

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:uos:1.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "51F4069E-611B-4A4E-883A-F51DE9FF7B9E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACCFC4B1-37DD-4BF7-86A9-5F0A9A2C1D07",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "875DC0B8-0189-4952-9FD8-00970F4C72F5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3697878-4927-4381-BA26-3FD9A08D7661",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de gesti\u00f3n de privilegios inadecuada en la funci\u00f3n de recuperaci\u00f3n de la versi\u00f3n de firmware uOS V1.31 y anteriores de la serie USG FLEX H podr\u00eda permitir que un atacante local autenticado con privilegios de administrador cargue un archivo de configuraci\u00f3n manipulado y escale privilegios en un dispositivo vulnerable."
    }
  ],
  "id": "CVE-2025-1732",
  "lastModified": "2025-10-30T17:56:11.717",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "security@zyxel.com.tw",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-22T03:15:21.337",
  "references": [
    {
      "source": "security@zyxel.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "security@zyxel.com.tw",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2025-1731

Vulnerability from fkie_nvd - Published: 2025-04-22 03:15 - Updated: 2025-10-30 17:55
Summary
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:uos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4CCD46D-8AAF-4ABC-B9CF-AE1ED1F45D48",
              "versionEndExcluding": "1.32",
              "versionStartIncluding": "1.20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACCFC4B1-37DD-4BF7-86A9-5F0A9A2C1D07",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "875DC0B8-0189-4952-9FD8-00970F4C72F5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3697878-4927-4381-BA26-3FD9A08D7661",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de asignaci\u00f3n incorrecta de permisos en los comandos PostgreSQL de las versiones de firmware uOS de la serie USG FLEX H, de la V1.20 a la V1.31, podr\u00eda permitir que un atacante local autenticado con privilegios bajos acceda al shell de Linux y aumente sus privilegios mediante la creaci\u00f3n de scripts maliciosos o la modificaci\u00f3n de la configuraci\u00f3n del sistema con acceso de administrador mediante un token robado. La modificaci\u00f3n de la configuraci\u00f3n del sistema solo es posible si el administrador no ha cerrado sesi\u00f3n y el token sigue siendo v\u00e1lido."
    }
  ],
  "id": "CVE-2025-1731",
  "lastModified": "2025-10-30T17:55:46.857",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security@zyxel.com.tw",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-22T03:15:21.177",
  "references": [
    {
      "source": "security@zyxel.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://seclists.org/fulldisclosure/2025/Apr/27"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "security@zyxel.com.tw",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2024-9677

Vulnerability from fkie_nvd - Published: 2024-10-22 02:15 - Updated: 2024-12-05 22:11
Summary
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
Impacted products

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:uos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B53BCCF3-FFFC-4E52-997E-36A632C81F00",
              "versionEndExcluding": "1.30",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions\u00a0could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de credenciales insuficientemente protegidas en el comando CLI de la versi\u00f3n de firmware uOS V1.21 y versiones anteriores de la serie USG FLEX H podr\u00eda permitir que un atacante local autenticado obtenga una escalada de privilegios al robar el token de autenticaci\u00f3n de un administrador que inici\u00f3 sesi\u00f3n. Tenga en cuenta que este ataque podr\u00eda tener \u00e9xito solo si el administrador no ha cerrado sesi\u00f3n."
    }
  ],
  "id": "CVE-2024-9677",
  "lastModified": "2024-12-05T22:11:15.217",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "security@zyxel.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-22T02:15:04.380",
  "references": [
    {
      "source": "security@zyxel.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "security@zyxel.com.tw",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-6399

Vulnerability from fkie_nvd - Published: 2024-02-20 02:15 - Updated: 2025-01-21 18:36
Summary
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.
Impacted products
Vendor Product Version
zyxel atp100_firmware *
zyxel atp100_firmware 5.37
zyxel atp100_firmware 5.37
zyxel atp100 -
zyxel atp100w_firmware *
zyxel atp100w_firmware 5.37
zyxel atp100w_firmware 5.37
zyxel atp100w -
zyxel atp200_firmware *
zyxel atp200_firmware 5.37
zyxel atp200_firmware 5.37
zyxel atp200 -
zyxel atp500_firmware *
zyxel atp500_firmware 5.37
zyxel atp500_firmware 5.37
zyxel atp500 -
zyxel atp700_firmware *
zyxel atp700_firmware 5.37
zyxel atp700_firmware 5.37
zyxel atp700 -
zyxel atp800_firmware *
zyxel atp800_firmware 5.37
zyxel atp800_firmware 5.37
zyxel atp800 -
zyxel usg_flex_100_firmware *
zyxel usg_flex_100_firmware 5.37
zyxel usg_flex_100_firmware 5.37
zyxel usg_flex_100 -
zyxel usg_flex_100ax_firmware *
zyxel usg_flex_100ax_firmware 5.37
zyxel usg_flex_100ax_firmware 5.37
zyxel usg_flex_100ax -
zyxel usg_flex_100h_firmware *
zyxel usg_flex_100h_firmware 5.37
zyxel usg_flex_100h_firmware 5.37
zyxel usg_flex_100h -
zyxel usg_flex_100w_firmware *
zyxel usg_flex_100w_firmware 5.37
zyxel usg_flex_100w_firmware 5.37
zyxel usg_flex_100w -
zyxel usg_flex_200_firmware *
zyxel usg_flex_200_firmware 5.37
zyxel usg_flex_200_firmware 5.37
zyxel usg_flex_200 -
zyxel usg_flex_200h_firmware *
zyxel usg_flex_200h_firmware 5.37
zyxel usg_flex_200h_firmware 5.37
zyxel usg_flex_200h -
zyxel usg_flex_200hp_firmware *
zyxel usg_flex_200hp_firmware 5.37
zyxel usg_flex_200hp_firmware 5.37
zyxel usg_flex_200hp -
zyxel usg_flex_500_firmware *
zyxel usg_flex_500_firmware 5.37
zyxel usg_flex_500_firmware 5.37
zyxel usg_flex_500 -
zyxel usg_flex_500h_firmware *
zyxel usg_flex_500h_firmware 5.37
zyxel usg_flex_500h_firmware 5.37
zyxel usg_flex_500h -
zyxel usg_flex_700_firmware *
zyxel usg_flex_700_firmware 5.37
zyxel usg_flex_700_firmware 5.37
zyxel usg_flex_700 -
zyxel usg_flex_700h_firmware *
zyxel usg_flex_700h_firmware 5.37
zyxel usg_flex_700h_firmware 5.37
zyxel usg_flex_700h -
zyxel usg_flex_50_firmware *
zyxel usg_flex_50_firmware 5.37
zyxel usg_flex_50_firmware 5.37
zyxel usg_flex_50 -
zyxel usg_flex_50w_firmware *
zyxel usg_flex_50w_firmware 5.37
zyxel usg_flex_50w_firmware 5.37
zyxel usg_flex_50w -
zyxel usg20-vpn_firmware *
zyxel usg20-vpn_firmware 5.37
zyxel usg20-vpn_firmware 5.37
zyxel usg20-vpn -
zyxel usg20w-vpn_firmware *
zyxel usg20w-vpn_firmware 5.37
zyxel usg20w-vpn_firmware 5.37
zyxel usg20w-vpn -
zyxel uos 1.10
zyxel uos 1.10
zyxel usg_flex_100h -
zyxel usg_flex_100hp -
zyxel usg_flex_200h -
zyxel usg_flex_200hp -
zyxel usg_flex_500h -
zyxel usg_flex_700h -

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88A27486-8F61-46B1-AA77-1249E75DD8CC",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "121E2131-A6CB-4714-BD0B-9CDBFF924F10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "C4AA7A4F-E00F-4CFA-8B4F-305BEC37F0B8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "218B2397-5415-4AC0-BFA4-7D24640EF76E",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "F750721F-73AD-4BDD-A407-72D8DEB30C68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "069E7437-BF71-4F73-8C0A-44DC9804492B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F16582B0-232D-4815-86D5-1CFFFFE5990D",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "B20F854E-486D-46C0-90C8-81153573FEF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "DE71538C-16FD-43B1-B6CD-EB5988AFB7BF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C968353-8FC1-45B7-A2D0-F6713A3BC760",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "9E8933B8-F66E-4667-955E-DB5486534C5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "6F694EDC-DEF2-47D4-BCF0-32972EF8CEA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "36C951EB-8950-4927-8F99-81EE1B4856F7",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "0E3E890B-8BDE-4C22-BFF7-B87495C71C48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "3037AE20-8F8B-4656-9534-6436A8AEA8C9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF54B670-3135-4AF9-B72D-F4D8BEE48878",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "67FA1CEC-DED7-46D4-A4FC-780431B3EE2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "DFD1CE91-B72C-4589-9A5F-F1164C0193AB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "700227C4-A23F-4CFF-839F-B61A44E0E34E",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DF266069-4FA5-4343-B62C-0940A0C61566",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "99E0ECA5-7FE6-4E56-A741-E3260C99A43A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF23ACF5-9961-4BA9-84D2-C09EF39790D2",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "395E8D72-E9F6-4923-B4DE-875D195B27F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "FCBEDDCD-A9F6-4E07-ADF8-B1E9C557CDEC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "03036815-04AE-4E39-8310-DA19A32CFA48",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A8EFB09-4987-4CB6-838D-A15D47A2000D",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "45EEA203-C4E3-4916-A9E5-15AB994B53FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "A21576D3-6A3F-451C-9B62-E0B0418D5529",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F24FD1EE-4527-4A9D-AFF6-086EB5A30347",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DC61CF4F-74D5-4C96-8D8A-779436CF344D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "25EB6607-7241-4D01-BC87-3C3E62B27B6B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61F127FD-22D4-48CC-95FC-321722683A6D",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "8E4CC2FF-2BB1-43E8-A7AA-56A220705FE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "31206A47-4A01-4FB7-A0AA-E9D22C63941D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8198C3A9-5F65-4FC8-8997-81BEB218FE0D",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "CBDE985D-B016-4303-8EE6-904C79F8FE82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "0ACD16E9-7EE0-4AD5-9D71-121AFAEF7947",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A91D7A49-19EA-43E6-BA4C-A92814DCE37B",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "9EE95AED-D8FB-44BD-856D-2F7A6DB2AABA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "D764B87E-8B23-4C33-93BB-59B23CFEADBC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7494CE3-5299-4B2D-B432-CDAC50D30103",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "D9D7FBB8-C983-4EFA-90CB-EC5C6A26D112",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "5CDA1267-E136-4932-9627-B4D12DB17E27",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "135DA0CD-2403-44F0-97CF-290B33B4CFAF",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "1D168F82-50CE-4E25-B1D9-B50F69463F5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "9A0B9A2C-772B-4669-BC7C-71FA32B1B4EA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D57C8E7-6126-4A9D-A24A-F56719A59E8B",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "A1FEDD30-0B80-4F07-8475-156B9FE46883",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "3953AFFC-18E6-46AA-BC99-EA65726E4D9E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "42F9F198-3A49-4BD9-952B-B95E4E3EC19A",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "A5A45A9D-D9C7-495D-BD83-EE088746FD36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "606D09B9-0376-4277-9964-F0580D65C3E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FB8F3CE-5EE9-41AD-9CB3-014BE1F51F27",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "5476C178-E553-44FC-854B-5851F0F28469",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "C2D65155-CDF2-4A99-94CA-D4B61B26D32C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F8F9B1A-BC4D-450B-86D3-31FDCFAB2BCF",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DC8C2C47-FE8E-4496-9648-0B264A9A2EA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "EEB68246-FD4B-4FB6-9140-63725EA24660",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF5BE31C-A1A5-45E1-8E75-804FE2BB5E8D",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "B0BFA01B-1328-4F96-AE56-D39416A54F0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "ABB0C1EC-512C-4A00-84C6-4F93FDD7739F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7239C54F-EC9E-44B4-AE33-1D36E5448219",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9927F99-F8B9-43D6-942B-3BADA5F4970F",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "D8470EFC-2AED-45A3-8F4E-CF8EB8EB43D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "AFD0A4B7-5A6D-4DAE-9FA4-559F9932A92B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "06D2AD3A-9197-487D-A267-24DE332CC66B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:*",
              "matchCriteriaId": "AD61F9D7-0229-4A40-903E-F25F67E547F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "29B81F51-C82B-4099-99B4-5A53BAAA45C0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACCFC4B1-37DD-4BF7-86A9-5F0A9A2C1D07",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u00a0USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cadena de formato en las versiones de firmware de la serie Zyxel ATP desde 4.32 hasta 5.37 Parche 1, versiones de firmware de la serie USG FLEX desde 4.50 hasta 5.37 Parche 1, versiones de firmware de la serie USG FLEX 50(W) desde 4.16 hasta 5.37 Parche 1 y USG20(W) -Las versiones de firmware de la serie VPN desde la 4.16 hasta la 5.37, parche 1, podr\u00edan permitir que un usuario de VPN IPSec autenticado provoque condiciones DoS contra el demonio \"deviceid\" enviando un nombre de host manipulado a un dispositivo afectado si tiene habilitada la funci\u00f3n \"Device Insight\"."
    }
  ],
  "id": "CVE-2023-6399",
  "lastModified": "2025-01-21T18:36:34.413",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "security@zyxel.com.tw",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-02-20T02:15:49.407",
  "references": [
    {
      "source": "security@zyxel.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ],
      "source": "security@zyxel.com.tw",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-6398

Vulnerability from fkie_nvd - Published: 2024-02-20 02:15 - Updated: 2025-01-21 18:36
Summary
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.
Impacted products
Vendor Product Version
zyxel atp100_firmware *
zyxel atp100_firmware 5.37
zyxel atp100_firmware 5.37
zyxel atp100 -
zyxel atp100w_firmware *
zyxel atp100w_firmware 5.37
zyxel atp100w_firmware 5.37
zyxel atp100w -
zyxel atp200_firmware *
zyxel atp200_firmware 5.37
zyxel atp200_firmware 5.37
zyxel atp200 -
zyxel atp500_firmware *
zyxel atp500_firmware 5.37
zyxel atp500_firmware 5.37
zyxel atp500 -
zyxel atp700_firmware *
zyxel atp700_firmware 5.37
zyxel atp700_firmware 5.37
zyxel atp700 -
zyxel atp800_firmware *
zyxel atp800_firmware 5.37
zyxel atp800_firmware 5.37
zyxel atp800 -
zyxel usg_flex_100_firmware *
zyxel usg_flex_100_firmware 5.37
zyxel usg_flex_100_firmware 5.37
zyxel usg_flex_100 -
zyxel usg_flex_100ax_firmware *
zyxel usg_flex_100ax_firmware 5.37
zyxel usg_flex_100ax_firmware 5.37
zyxel usg_flex_100ax -
zyxel usg_flex_100h_firmware *
zyxel usg_flex_100h_firmware 5.37
zyxel usg_flex_100h_firmware 5.37
zyxel usg_flex_100h -
zyxel usg_flex_100w_firmware *
zyxel usg_flex_100w_firmware 5.37
zyxel usg_flex_100w_firmware 5.37
zyxel usg_flex_100w -
zyxel usg_flex_200_firmware *
zyxel usg_flex_200_firmware 5.37
zyxel usg_flex_200_firmware 5.37
zyxel usg_flex_200 -
zyxel usg_flex_200h_firmware *
zyxel usg_flex_200h_firmware 5.37
zyxel usg_flex_200h_firmware 5.37
zyxel usg_flex_200h -
zyxel usg_flex_200hp_firmware *
zyxel usg_flex_200hp_firmware 5.37
zyxel usg_flex_200hp_firmware 5.37
zyxel usg_flex_200hp -
zyxel usg_flex_50_firmware *
zyxel usg_flex_50_firmware 5.37
zyxel usg_flex_50_firmware 5.37
zyxel usg_flex_50 -
zyxel usg_flex_500_firmware *
zyxel usg_flex_500_firmware 5.37
zyxel usg_flex_500_firmware 5.37
zyxel usg_flex_500 -
zyxel usg_flex_500h_firmware *
zyxel usg_flex_500h_firmware 5.37
zyxel usg_flex_500h_firmware 5.37
zyxel usg_flex_500h -
zyxel usg_flex_50w_firmware *
zyxel usg_flex_50w_firmware 5.37
zyxel usg_flex_50w_firmware 5.37
zyxel usg_flex_50w -
zyxel usg_flex_700_firmware *
zyxel usg_flex_700_firmware 5.37
zyxel usg_flex_700_firmware 5.37
zyxel usg_flex_700 -
zyxel usg_flex_700h_firmware *
zyxel usg_flex_700h_firmware 5.37
zyxel usg_flex_700h_firmware 5.37
zyxel usg_flex_700h -
zyxel usg20-vpn_firmware *
zyxel usg20-vpn_firmware 5.37
zyxel usg20-vpn_firmware 5.37
zyxel usg20-vpn -
zyxel usg20w-vpn_firmware *
zyxel usg20w-vpn_firmware 5.37
zyxel usg20w-vpn_firmware 5.37
zyxel usg20w-vpn -
zyxel uos 1.10
zyxel uos 1.10
zyxel usg_flex_100h -
zyxel usg_flex_100hp -
zyxel usg_flex_200h -
zyxel usg_flex_200hp -
zyxel usg_flex_500h -
zyxel usg_flex_700h -
zyxel nwa50ax_firmware *
zyxel nwa50ax -
zyxel nwa55axe_firmware *
zyxel nwa55axe -
zyxel nwa90ax_firmware *
zyxel nwa90ax -
zyxel nwa110ax_firmware *
zyxel nwa110ax -
zyxel nwa210ax_firmware *
zyxel nwa210ax -
zyxel nwa220ax-6e_firmware *
zyxel nwa220ax-6e -
zyxel nwa1123acv3_firmware *
zyxel nwa1123acv3 -
zyxel wac500_firmware *
zyxel wac500 -
zyxel wac500h_firmware *
zyxel wac500h -
zyxel wax300h_firmware *
zyxel wax300h -
zyxel wax510d_firmware *
zyxel wax510d -
zyxel wax610d_firmware *
zyxel wax610d -
zyxel wax620d-6e_firmware *
zyxel wax620d-6e -
zyxel wax630s_firmware *
zyxel wax630s -
zyxel wax640s-6e_firmware *
zyxel wax640s-6e -
zyxel wax650s_firmware *
zyxel wax650s -
zyxel wax655e_firmware *
zyxel wax655e -
zyxel wbe660s_firmware *
zyxel wbe660s -
zyxel nwa50ax-pro_firmware *
zyxel nwa50ax-pro -
zyxel nwa90ax-pro_firmware *
zyxel nwa90ax-pro -

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "22B1CC86-551C-4CF1-9905-22D983C87B0C",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "121E2131-A6CB-4714-BD0B-9CDBFF924F10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "C4AA7A4F-E00F-4CFA-8B4F-305BEC37F0B8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E4D7828-078E-4418-9F04-302FC7F8BB25",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "F750721F-73AD-4BDD-A407-72D8DEB30C68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp100w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "069E7437-BF71-4F73-8C0A-44DC9804492B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67DC678C-8CA1-4289-A69B-435FE3374BCD",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "B20F854E-486D-46C0-90C8-81153573FEF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp200_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "DE71538C-16FD-43B1-B6CD-EB5988AFB7BF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5C9B7E5-F548-4F9F-8CA7-20B7D41DF0AC",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "9E8933B8-F66E-4667-955E-DB5486534C5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp500_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "6F694EDC-DEF2-47D4-BCF0-32972EF8CEA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E1974D6-04C1-4135-812D-6901712940EE",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "0E3E890B-8BDE-4C22-BFF7-B87495C71C48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp700_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "3037AE20-8F8B-4656-9534-6436A8AEA8C9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "21C4C98F-B383-4F2F-B84E-3C6DDD8437DB",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "67FA1CEC-DED7-46D4-A4FC-780431B3EE2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:atp800_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "DFD1CE91-B72C-4589-9A5F-F1164C0193AB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D66CA5F-C85F-4D69-8F82-BDCF6FCB905C",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DF266069-4FA5-4343-B62C-0940A0C61566",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "99E0ECA5-7FE6-4E56-A741-E3260C99A43A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B30A4C0-9928-46AD-9210-C25656FB43FB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CF216E5-870B-4C6E-9CFA-A5FB6F476CB0",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "395E8D72-E9F6-4923-B4DE-875D195B27F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "FCBEDDCD-A9F6-4E07-ADF8-B1E9C557CDEC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "03036815-04AE-4E39-8310-DA19A32CFA48",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C220BBFF-29A6-483B-9806-6A966625EFEE",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "45EEA203-C4E3-4916-A9E5-15AB994B53FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "A21576D3-6A3F-451C-9B62-E0B0418D5529",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5E31FC3-E2EC-4909-BF8D-86775AF4D4B5",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DC61CF4F-74D5-4C96-8D8A-779436CF344D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "25EB6607-7241-4D01-BC87-3C3E62B27B6B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6EF9AA9-65D5-4D7B-A2BF-9150C6339282",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "8E4CC2FF-2BB1-43E8-A7AA-56A220705FE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "31206A47-4A01-4FB7-A0AA-E9D22C63941D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "69B29C9B-DB92-4DBD-9F83-1C9FABAC81B4",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "CBDE985D-B016-4303-8EE6-904C79F8FE82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "0ACD16E9-7EE0-4AD5-9D71-121AFAEF7947",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCC129C3-AD72-44AE-B89D-5BF40559B9F4",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "9EE95AED-D8FB-44BD-856D-2F7A6DB2AABA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "D764B87E-8B23-4C33-93BB-59B23CFEADBC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C93BA9-E4F3-48F3-8D58-92409905AC03",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "5476C178-E553-44FC-854B-5851F0F28469",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "C2D65155-CDF2-4A99-94CA-D4B61B26D32C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "646C1F07-B553-47B0-953B-DC7DE7FD0F8B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B221F5CD-C0C6-4917-AC15-FF1BA3904915",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "D9D7FBB8-C983-4EFA-90CB-EC5C6A26D112",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "5CDA1267-E136-4932-9627-B4D12DB17E27",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8ACA5C0-F9AC-4986-95CF-74A92DEAF45E",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "1D168F82-50CE-4E25-B1D9-B50F69463F5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_500h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "9A0B9A2C-772B-4669-BC7C-71FA32B1B4EA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A2842FD-23CC-4E12-AF08-979035695E5F",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "DC8C2C47-FE8E-4496-9648-0B264A9A2EA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "EEB68246-FD4B-4FB6-9140-63725EA24660",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FA43EB7-3F72-4250-BE9A-7449B8AEF90F",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "A1FEDD30-0B80-4F07-8475-156B9FE46883",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "3953AFFC-18E6-46AA-BC99-EA65726E4D9E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D051AE62-28E7-4626-B5CB-F4B244260A0E",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "A5A45A9D-D9C7-495D-BD83-EE088746FD36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg_flex_700h_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "606D09B9-0376-4277-9964-F0580D65C3E0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E10984B-2ACA-4B15-AF74-F6E7D467DA8B",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "B0BFA01B-1328-4F96-AE56-D39416A54F0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20-vpn_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "ABB0C1EC-512C-4A00-84C6-4F93FDD7739F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7239C54F-EC9E-44B4-AE33-1D36E5448219",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE25FC75-B93D-4010-A255-2AF732D47674",
              "versionEndExcluding": "5.37",
              "versionStartIncluding": "4.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:-:*:*:*:*:*:*",
              "matchCriteriaId": "D8470EFC-2AED-45A3-8F4E-CF8EB8EB43D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:5.37:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "AFD0A4B7-5A6D-4DAE-9FA4-559F9932A92B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "06D2AD3A-9197-487D-A267-24DE332CC66B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:uos:1.10:-:*:*:*:*:*:*",
              "matchCriteriaId": "AD61F9D7-0229-4A40-903E-F25F67E547F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zyxel:uos:1.10:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "29B81F51-C82B-4099-99B4-5A53BAAA45C0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED28D5ED-B21A-4CD6-947E-9C21EA801B7D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_100hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACCFC4B1-37DD-4BF7-86A9-5F0A9A2C1D07",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09D15ECD-4942-407A-A62E-9785568C6B78",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD7E9028-1ECB-4D88-84D8-CFC589B429AE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE57BCA4-8631-460A-BFE3-BB765E5D009F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8832743A-99FA-417E-BCE1-4BF7D4CEF9BE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F35D4CA0-0E9B-4284-B72F-1151BCC85A82",
              "versionEndExcluding": "6.29\\(abyw.4\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa50ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2806A3B3-8F13-4170-B284-8809E3502044",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97593633-CDCA-4F99-AD92-3E64E2262539",
              "versionEndExcluding": "6.29\\(abzl.4\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa55axe:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7440976-5CB4-40BE-95C2-98EF4B888109",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A47F336-D8B8-4B99-AE3E-6694BE7A2BFB",
              "versionEndExcluding": "6.29\\(accv.4\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa90ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A903978-737E-4266-A670-BC94E32CAF96",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3580D6A6-24F7-4759-BFF4-D7A7A83477FE",
              "versionEndExcluding": "6.70\\(abtg.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa110ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A3F9232-F988-4428-9898-4F536123CE88",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9CC634A9-79A8-4562-BDD5-79AE7A3AA3B3",
              "versionEndExcluding": "6.70\\(abtd.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa210ax:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BB129F9-64D8-43C2-9366-51EBDF419F5F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CF0E904-747A-4799-929D-2838173DF657",
              "versionEndExcluding": "6.70\\(acco.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa220ax-6e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E03F755-424D-4248-9076-ED7BECEB94C5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3FFADE1-8BC3-4DC1-ACC6-5FEC0D6F2738",
              "versionEndExcluding": "6.70\\(abvt.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa1123acv3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "36C13E7F-2186-4587-83E9-57B05A7147B7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CEB667E-C8BC-4ECF-8D69-046C01546AE9",
              "versionEndExcluding": "6.70\\(abvs.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wac500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C024551-F08F-4152-940D-1CF8BCD79613",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE0BD60E-14CF-4D36-B443-C2CAB4B85564",
              "versionEndExcluding": "6.70\\(abwa.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wac500h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A1FD502-4F62-4C77-B3BC-E563B24F0067",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1C7861D-27F0-466A-8FE0-9253F2A8BC70",
              "versionEndExcluding": "6.70\\(achf.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax300h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3073565-BCDF-46EA-8FB0-E9BF402A5122",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A004988-13FC-4289-9CC6-D88D4DBC6818",
              "versionEndExcluding": "6.70\\(abtf.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax510d:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A37A0E9-D505-4376-AB0E-1C0FD7E53A55",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FF2C2C3-F31D-4C2A-9DFF-733273AABFB2",
              "versionEndExcluding": "6.70\\(abte.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax610d:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3518DA0A-2C7B-4979-A457-0826C921B0F0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FABC195A-5D2C-40DE-A23B-FA0B4D7AF303",
              "versionEndExcluding": "6.70\\(accn.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax620d-6e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B4EBCC9-4FF9-41FC-9FFE-DBFAB239888B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E42CE181-704A-491C-BDE6-D9195AB99686",
              "versionEndExcluding": "6.70\\(abzd.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax630s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC74AAF9-5206-4CEB-9023-6CD4F38AA623",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF887F95-F742-414D-B461-0EB1396885E4",
              "versionEndExcluding": "6.70\\(accm.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax640s-6e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "20E4E9A0-DF92-47B7-94D6-0867E3171E47",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3855AC8-C642-4C2B-A21D-5D3D78FCF61F",
              "versionEndExcluding": "6.70\\(abrm.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax650s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D784994E-E2CE-4328-B490-D9DC195A53DB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A700911F-3CE7-4E72-AD7B-5116F90E9C69",
              "versionEndExcluding": "6.70\\(acdo.1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wax655e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "61158220-B5E8-4BF4-B2C2-E8ABFD3266CF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "10E6DCC0-5C84-4B0B-8000-F326DC52F740",
              "versionEndExcluding": "6.70\\(acgg.2\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:wbe660s:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FC2F3A4-0598-49B0-9829-AF43C97E9E8E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa50ax-pro_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A88CCD01-D827-4891-8E99-67B6FD064FE9",
              "versionEndExcluding": "6.80\\(acge.0\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa50ax-pro:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7DD6E6B-61EC-4E60-8244-56ADB26F2234",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwa90ax-pro_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D936894-A119-4EC4-BA51-3B2CD9F3F477",
              "versionEndExcluding": "6.80\\(acgf.0\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwa90ax-pro:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFA44855-B135-44BD-AE21-FC58CD647AB6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n en el binario de carga de archivos en las versiones de firmware de la serie Zyxel ATP de 4.32 a 5.37, parche 1, versiones de firmware de la serie USG FLEX de 4.50 a 5.37, parche 1, versiones de firmware de la serie USG FLEX 50(W) de 4.16 a 5.37 Parche 1, versiones de firmware de la serie USG20(W)-VPN desde 4.16 hasta 5.37 Parche 1, versiones de firmware NWA50AX hasta 6.29(ABYW.3), versiones de firmware WAC500 hasta 6.65(ABVS.1), versiones de firmware WAX300H hasta 6.60(ACHF.1 ), y las versiones de firmware WBE660S hasta 6.65 (ACGG.1) podr\u00edan permitir que un atacante autenticado con privilegios de administrador ejecute algunos comandos del sistema operativo (SO) en un dispositivo afectado a trav\u00e9s de FTP."
    }
  ],
  "id": "CVE-2023-6398",
  "lastModified": "2025-01-21T18:36:54.507",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "security@zyxel.com.tw",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-02-20T02:15:49.110",
  "references": [
    {
      "source": "security@zyxel.com.tw",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security@zyxel.com.tw",
      "type": "Secondary"
    }
  ]
}

CVE-2025-1732 (GCVE-0-2025-1732)

Vulnerability from cvelistv5 – Published: 2025-04-22 01:57 – Updated: 2025-06-12 07:05
VLAI?
Summary
An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device.
CWE
  • CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T03:56:05.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= V1.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device."
            }
          ],
          "value": "An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T07:05:39.793Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2025-1732",
    "datePublished": "2025-04-22T01:57:35.395Z",
    "dateReserved": "2025-02-27T03:13:45.776Z",
    "dateUpdated": "2025-06-12T07:05:39.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1731 (GCVE-0-2025-1731)

Vulnerability from cvelistv5 – Published: 2025-04-22 01:52 – Updated: 2025-06-12 07:06
VLAI?
Summary
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
Vendor Product Version
Zyxel USG FLEX H series uOS firmware Affected: from V1.20 through V1.31
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-02T03:55:17.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-24T06:04:04.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/27"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "from V1.20 through V1.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid."
            }
          ],
          "value": "An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T07:06:19.271Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2025-1731",
    "datePublished": "2025-04-22T01:52:04.064Z",
    "dateReserved": "2025-02-27T03:13:40.559Z",
    "dateUpdated": "2025-06-12T07:06:19.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9677 (GCVE-0-2024-9677)

Vulnerability from cvelistv5 – Published: 2024-10-22 01:19 – Updated: 2024-10-22 15:52
VLAI?
Summary
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
CWE
  • CWE-522 - Insufficiently Protected Credentials
Assigner
References
Impacted products
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_700h_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "1.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T14:29:58.494312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T15:52:56.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= V1.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions\u0026nbsp;could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out."
            }
          ],
          "value": "The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions\u00a0could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-22T01:19:53.188Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2024-9677",
    "datePublished": "2024-10-22T01:19:53.188Z",
    "dateReserved": "2024-10-09T05:14:46.238Z",
    "dateUpdated": "2024-10-22T15:52:56.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6399 (GCVE-0-2023-6399)

Vulnerability from cvelistv5 – Published: 2024-02-20 01:42 – Updated: 2024-08-02 08:28
VLAI?
Summary
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.
CWE
  • CWE-134 - Use of Externally-Controlled Format String
Assigner
References
Impacted products
Vendor Product Version
Zyxel ATP series firmware Affected: version 4.32 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX series firmware Affected: version 4.50 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX 50(W) series firmware Affected: version 4.16 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG20(W)-VPN series firmware Affected: version 4.16 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX H series firmware Affected: version 1.10 through 1.10 Patch 1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:30:36.983773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:43.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.32 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.50 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 1.10 through 1.10 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u0026nbsp;USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled."
            }
          ],
          "value": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u00a0USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134 Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-21T09:20:18.921Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-6399",
    "datePublished": "2024-02-20T01:42:21.027Z",
    "dateReserved": "2023-11-30T07:58:19.503Z",
    "dateUpdated": "2024-08-02T08:28:21.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6398 (GCVE-0-2023-6398)

Vulnerability from cvelistv5 – Published: 2024-02-20 01:34 – Updated: 2024-08-25 15:46
VLAI?
Summary
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Zyxel ATP series firmware Affected: version 4.32 through 5.37 Patch 1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "atp800_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37_patch1",
                "status": "affected",
                "version": "4.32",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_700_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "5.37_patch1",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nwa50ax_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nwa50ax_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.29\\(abyw.4\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wac500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wac500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(abvs.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wax300h_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(achf.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wbe660s_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(acgg.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_20w-vpn_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37_patch1",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-01T05:01:04.429989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-25T15:46:49.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.32 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.50 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": " version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " NWA50AX firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.29(ABYW.4)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " WAC500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ABVS.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAX300H firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ACHF.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WBE660S firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ACGG.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 1.10 through 1.10 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP."
            }
          ],
          "value": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-21T09:17:30.230Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-6398",
    "datePublished": "2024-02-20T01:34:32.229Z",
    "dateReserved": "2023-11-30T07:58:16.356Z",
    "dateUpdated": "2024-08-25T15:46:49.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1732 (GCVE-0-2025-1732)

Vulnerability from nvd – Published: 2025-04-22 01:57 – Updated: 2025-06-12 07:05
VLAI?
Summary
An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device.
CWE
  • CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T03:56:05.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= V1.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device."
            }
          ],
          "value": "An improper privilege management vulnerability in the recovery function of the Zyxel USG FLEX H series uOS firmware version V1.31 and earlier could allow an authenticated local attacker with administrator privileges to upload a crafted configuration file and escalate privileges on a vulnerable device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T07:05:39.793Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2025-1732",
    "datePublished": "2025-04-22T01:57:35.395Z",
    "dateReserved": "2025-02-27T03:13:45.776Z",
    "dateUpdated": "2025-06-12T07:05:39.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-1731 (GCVE-0-2025-1731)

Vulnerability from nvd – Published: 2025-04-22 01:52 – Updated: 2025-06-12 07:06
VLAI?
Summary
An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.
CWE
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
Vendor Product Version
Zyxel USG FLEX H series uOS firmware Affected: from V1.20 through V1.31
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-02T03:55:17.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-24T06:04:04.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/27"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "from V1.20 through V1.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid."
            }
          ],
          "value": "An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T07:06:19.271Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-incorrect-permission-assignment-and-improper-privilege-management-vulnerabilities-in-usg-flex-h-series-firewalls-04-22-2025"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2025-1731",
    "datePublished": "2025-04-22T01:52:04.064Z",
    "dateReserved": "2025-02-27T03:13:40.559Z",
    "dateUpdated": "2025-06-12T07:06:19.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9677 (GCVE-0-2024-9677)

Vulnerability from nvd – Published: 2024-10-22 01:19 – Updated: 2024-10-22 15:52
VLAI?
Summary
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
CWE
  • CWE-522 - Insufficiently Protected Credentials
Assigner
References
Impacted products
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200hp_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_700h_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "1.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T14:29:58.494312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T15:52:56.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series uOS firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= V1.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions\u0026nbsp;could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out."
            }
          ],
          "value": "The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions\u00a0could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-22T01:19:53.188Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2024-9677",
    "datePublished": "2024-10-22T01:19:53.188Z",
    "dateReserved": "2024-10-09T05:14:46.238Z",
    "dateUpdated": "2024-10-22T15:52:56.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6399 (GCVE-0-2023-6399)

Vulnerability from nvd – Published: 2024-02-20 01:42 – Updated: 2024-08-02 08:28
VLAI?
Summary
A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.
CWE
  • CWE-134 - Use of Externally-Controlled Format String
Assigner
References
Impacted products
Vendor Product Version
Zyxel ATP series firmware Affected: version 4.32 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX series firmware Affected: version 4.50 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX 50(W) series firmware Affected: version 4.16 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG20(W)-VPN series firmware Affected: version 4.16 through 5.37 Patch 1
Create a notification for this product.
    Zyxel USG FLEX H series firmware Affected: version 1.10 through 1.10 Patch 1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:30:36.983773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:43.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.32 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.50 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 1.10 through 1.10 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u0026nbsp;USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled."
            }
          ],
          "value": "A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and\u00a0USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the \u201cdeviceid\u201d daemon by sending a crafted hostname to an affected device if it has the \u201cDevice Insight\u201d feature enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134 Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-21T09:20:18.921Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-6399",
    "datePublished": "2024-02-20T01:42:21.027Z",
    "dateReserved": "2023-11-30T07:58:19.503Z",
    "dateUpdated": "2024-08-02T08:28:21.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6398 (GCVE-0-2023-6398)

Vulnerability from nvd – Published: 2024-02-20 01:34 – Updated: 2024-08-25 15:46
VLAI?
Summary
A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Zyxel ATP series firmware Affected: version 4.32 through 5.37 Patch 1
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "atp800_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37_patch1",
                "status": "affected",
                "version": "4.32",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_flex_700_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "5.37_patch1",
                "status": "affected",
                "version": "4.50",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:nwa50ax_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nwa50ax_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.29\\(abyw.4\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wac500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wac500_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(abvs.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wax300h_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(achf.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wbe660s_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThan": "6.70\\(acgg.1\\)",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_20w-vpn_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usg_20w-vpn_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.37_patch1",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-01T05:01:04.429989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-25T15:46:49.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.32 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.50 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": " version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 4.16 through 5.37 Patch 1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " NWA50AX firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.29(ABYW.4)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": " WAC500 firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ABVS.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAX300H firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ACHF.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WBE660S firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.70(ACGG.1)"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX H series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "version 1.10 through 1.10 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP."
            }
          ],
          "value": "A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-21T09:17:30.230Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2023-6398",
    "datePublished": "2024-02-20T01:34:32.229Z",
    "dateReserved": "2023-11-30T07:58:16.356Z",
    "dateUpdated": "2024-08-25T15:46:49.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}