USG FLEX series firmware vulnerabilities | LiveThreat CVE Feed

Product

USG FLEX series firmware

by Zyxel · last CVE Aug 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities13 In the news0 Timeline

Severity mix

Critical 4High 7Medium 2Low 0

Severity

All severities13 Critical4 High7 Medium2 Low0

Exploitation

On CISA KEV4 Exploited in the wild4

Watch

Add USG FLEX series firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-11667 RansomwareIn wildKEV	9.8	3%	Nov 27	Zyxel Multiple Firewalls Path Traversal Vulnerability Affected: versions V5.00 through V5.38
CVE-2023-33009 In wildKEV	9.8	28%	May 24	Zyxel Multiple Firewalls Buffer Overflow Vulnerability Affected: 4.60 through 5.36 Patch 1
CVE-2023-33010 In wildKEV	9.8	29%	May 24	Zyxel Multiple Firewalls Buffer Overflow Vulnerability Affected: 4.50 through 5.36 Patch 1
CVE-2023-28771 In wildKEV	9.8	99%	Apr 25	Zyxel Multiple Firewalls OS Command Injection Vulnerability Affected: 4.60 through 5.35
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: versions V4.50 through V5.38
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: versions V4.50 through V5.38
CVE-2026-14818	7.2	1%	Aug 4	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series… Affected: from V4.50 through V5.42 Patch 1
CVE-2025-11730	7.2	1%	Feb 5	A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX… Affected: versions from V5.35 through V5.41
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: versions V4.50 through V5.38
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: versions V5.00 through V5.38
CVE-2024-7203	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38… Affected: versions V4.60 through V5.38
CVE-2024-42061	6.1	0%	Sep 3	A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series… Affected: versions V4.50 through V5.38
CVE-2024-6343	4.9	1%	Sep 3	A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG… Affected: versions V4.50 through V5.38