USG20(W)-VPN series firmware vulnerabilities | LiveThreat CVE Feed

Product

USG20(W)-VPN series firmware

by Zyxel · last CVE Aug 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 1High 5Medium 2Low 0

Severity

All severities8 Critical1 High5 Medium2 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add USG20(W)-VPN series firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-11667 RansomwareIn wildKEV	9.8	3%	Nov 27	Zyxel Multiple Firewalls Path Traversal Vulnerability Affected: versions V5.10 through V5.38
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: versions V4.16 through V5.38
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: versions V5.20 through V5.38
CVE-2026-14818	7.2	1%	Aug 4	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series… Affected: from V4.16 through V5.42 Patch 1
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: versions V4.16 through V5.38
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: versions V5.00 through V5.38
CVE-2024-42061	6.1	0%	Sep 3	A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series… Affected: versions V4.16 through V5.38
CVE-2024-6343	4.9	1%	Sep 3	A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG… Affected: versions V4.16 through V5.38