USG FLEX series firmware vulnerabilities | LiveThreat CVE Feed

Product

USG FLEX series firmware

by Zyxel · last CVE Aug 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 4High 9Medium 2Low 0

Severity

All severities15 Critical4 High9 Medium2 Low0

Exploitation

On CISA KEV4 Exploited in the wild4

Watch

Add USG FLEX series firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-9133	8.1	5%	Oct 21	A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W)… Affected: versions from V4.50 through V5.40
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: versions V4.50 through V5.38
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: versions V4.50 through V5.38
CVE-2026-14818	7.2	1%	Aug 4	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series… Affected: from V4.50 through V5.42 Patch 1
CVE-2025-11730	7.2	1%	Feb 5	A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX… Affected: versions from V5.35 through V5.41
CVE-2025-8078	7.2	1%	Oct 21	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40,… Affected: version from V4.50 through V5.40
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: versions V4.50 through V5.38
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: versions V5.00 through V5.38
CVE-2024-7203	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38… Affected: versions V4.60 through V5.38