Description
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| ATP series firmware | Zyxel / ATP series firmware | 5.10 through 5.21 Patch 1 | affected |
| USG 20(W)-VPN firmware | Zyxel / USG 20(W)-VPN firmware | 5.10 through 5.21 Patch 1 | affected |
| USG FLEX 100(W) firmware | Zyxel / USG FLEX 100(W) firmware | 5.00 through 5.21 Patch 1 | affected |
| USG FLEX 200 firmware | Zyxel / USG FLEX 200 firmware | 5.00 through 5.21 Patch 1 | affected |
| USG FLEX 500 firmware | Zyxel / USG FLEX 500 firmware | 5.00 through 5.21 Patch 1 | affected |
| USG FLEX 50(W) firmware | Zyxel / USG FLEX 50(W) firmware | 5.10 through 5.21 Patch 1 | affected |
| USG FLEX 700 firmware | Zyxel / USG FLEX 700 firmware | 5.00 through 5.21 Patch 1 | affected |
| VPN series firmware | Zyxel / VPN series firmware | 4.60 through 5.21 Patch 1 | affected |