Zld vulnerabilities | LiveThreat CVE Feed

Product

Zld

by Zyxel · last CVE Oct 21, 2025

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities21 In the news0 Timeline

Severity mix

Critical 2High 9Medium 10Low 0

Severity

All severities21 Critical2 High9 Medium10 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Zld to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-9133	8.1	5%	Oct 21	A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W)… Affected: 4.32 before 5.41; 4.50 before 5.41; 4.16 before 5.41
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: 4.32 before 5.39; 4.50 before 5.39; 4.16 before 5.39; 4.16 before 5.39
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: 4.32 before 5.39; 4.50 before 5.39; 4.20 before 5.39; 4.20 before 5.39
CVE-2023-4398	7.5	1%	Nov 28	An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX… Affected: 4.32 through 5.37; 4.50 through 5.37; 4.16 through 5.37; 4.30 through 5.37
CVE-2025-8078	7.2	1%	Oct 21	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40,… Affected: 4.32 before 5.41; 4.50 before 5.41; 4.16 before 5.41
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: 4.32 before 5.39; 4.50 before 5.39; 4.16 before 5.39; 4.16 before 5.39
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: 5.00 before 5.39; 5.00 before 5.39; 5.00 before 5.39
CVE-2024-7203	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38… Affected: 4.60 before 5.39; 4.60 before 5.39
CVE-2020-29299	7.2	2%	Dec 27	Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action Affected: before 4.39; before 4.55; before 4.55; before 4.39