High severity · published Dec 27, 2020
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action
7.2
CVSS
2.4%
EPSS
No
On KEV
Description
Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nsg Firmware · Zyxel
before 1.33; 1.33; 1.33 · source: NVD
UF
Usg Flex Firmware · Zyxel
All versions, or not specified · source: NVD
VO
Vpn Orchestrator · Zyxel
before 10.03 · source: NVD
ZL
Zld · Zyxel
before 4.39; before 4.55; before 4.55; before 4.39 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29299
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29299
Vendor Advisory
https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml
Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtml