USG FLEX 500 firmware vulnerabilities | LiveThreat CVE Feed

Product

USG FLEX 500 firmware

by Zyxel · last CVE Feb 20, 2024

On CISA KEVExploited in the wild

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities34 In the news0 Timeline

Severity mix

Critical 7High 18Medium 9Low 0

Severity

All severities34 Critical7 High18 Medium9 Low0

Exploitation

On CISA KEV5 Exploited in the wild5

Watch

Add USG FLEX 500 firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-6399	6.5	1%	Feb 20	A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX… Affected: 5.10 before 5.37; 5.37; 5.37
CVE-2023-34140	6.5	0%	Jul 17	A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W)… Affected: 4.50 before 5.37
CVE-2023-22918	6.5	1%	Apr 24	A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through… Affected: 4.50 before 5.36
CVE-2022-2030	6.5	1%	Jul 19	A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware… Affected: 4.50 through 5.30
CVE-2022-0910	6.5	1%	May 24	A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX… Affected: 4.50 through 5.21
CVE-2022-40603	6.1	0%	Dec 6	A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG… Affected: 4.50 through 5.31
CVE-2022-0734	6.1	9%	May 24	A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50… Affected: 4.50 through 5.20
CVE-2023-6397	5.3	0%	Feb 20	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1… Affected: 4.50 before 5.37; 5.37; 5.37
CVE-2023-27990	4.8	0%	Apr 24	The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware… Affected: 4.50 before 5.36