USG FLEX 50(W) series firmware vulnerabilities | LiveThreat CVE Feed

Product

USG FLEX 50(W) series firmware

by Zyxel · last CVE Aug 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities11 In the news0 Timeline

Severity mix

Critical 1High 8Medium 2Low 0

Severity

All severities11 Critical1 High8 Medium2 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add USG FLEX 50(W) series firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-9133	8.1	5%	Oct 21	A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W)… Affected: versions from V4.16 through V5.40
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: versions V4.16 through V5.38
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: versions V5.20 through V5.38
CVE-2026-14818	7.2	1%	Aug 4	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series… Affected: from V4.16 through V5.42 Patch 1
CVE-2025-11730	7.2	1%	Feb 5	A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX… Affected: versions from V5.35 through V5.41
CVE-2025-8078	7.2	1%	Oct 21	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40,… Affected: versions from V4.16 through V5.40
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: versions V4.16 through V5.38
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: versions V5.00 through V5.38