Advisories · Technology

Zyxel USG FLEX series firmware.

Every CVE that names Zyxel USG FLEX series firmware among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-14818 CVE record

CVSS 7.2 High

Path traversal in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Path traversal
Not analysed yet 4 Aug 2026
CVE-2025-11730 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 5 Feb 2026
CVE-2025-9133 CVE record

CVSS 8.1 High

Missing authorization in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Broken access control
Not analysed yet 21 Oct 2025
CVE-2025-8078 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 21 Oct 2025
CVE-2024-11667 CVE record

CVSS 7.5 HighCritical · KEVKEV · ransomware

Path traversal in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Path traversal
Not analysed yet 27 Nov 2024
CVE-2024-42061 CVE record

CVSS 6.1 Medium

Cross-site scripting in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2024
CVE-2024-42060 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 3 Sept 2024
CVE-2024-42059 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 3 Sept 2024
CVE-2024-42058 CVE record

CVSS 7.5 High

NULL pointer dereference in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2024-42057 CVE record

CVSS 8.1 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 3 Sept 2024
CVE-2024-7203 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 3 Sept 2024
CVE-2024-6343 CVE record

CVSS 4.9 Medium

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2023-6764 CVE record

CVSS 8.1 High

Uncontrolled format string in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2023-6399 CVE record

CVSS 5.7 Medium

Uncontrolled format string in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2023-6398 CVE record

CVSS 7.2 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 20 Feb 2024
CVE-2023-6397 CVE record

CVSS 6.5 Medium

NULL pointer dereference in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2023-5960 CVE record

CVSS 5.5 Medium

Improper privilege management in Zyxel USG FLEX series firmware and others
- Zyxel USG FLEX series firmware
- Zyxel VPN series firmware
- Privilege escalation
Not analysed yet 28 Nov 2023
CVE-2023-5797 CVE record

CVSS 5.5 Medium

Improper privilege management in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Privilege escalation
Not analysed yet 28 Nov 2023
CVE-2023-5650 CVE record

CVSS 5.5 Medium

Improper privilege management in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Privilege escalation
Not analysed yet 28 Nov 2023
CVE-2023-4398 CVE record

CVSS 7.5 High

Integer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 28 Nov 2023
CVE-2023-4397 CVE record

CVSS 4.4 Medium

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 28 Nov 2023
CVE-2023-37926 CVE record

CVSS 5.5 Medium

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 28 Nov 2023
CVE-2023-37925 CVE record

CVSS 5.5 Medium

Improper privilege management in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Privilege escalation
Not analysed yet 28 Nov 2023
CVE-2023-35139 CVE record

CVSS 5.2 Medium

Cross-site scripting in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Cross-site scripting (XSS)
Not analysed yet 28 Nov 2023
CVE-2023-35136 CVE record

CVSS 5.5 Medium

Improper input validation in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- CWE-20
Not analysed yet 28 Nov 2023
CVE-2023-34141 CVE record

CVSS 8.0 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 17 Jul 2023
CVE-2023-34140 CVE record

CVSS 6.5 Medium

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 17 Jul 2023
CVE-2023-34139 CVE record

CVSS 8.8 High

OS command injection in Zyxel USG FLEX series firmware and others
- Zyxel USG FLEX series firmware
- Zyxel VPN series firmware
- Command injection
Not analysed yet 17 Jul 2023
CVE-2023-34138 CVE record

CVSS 8.0 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 17 Jul 2023
CVE-2023-33012 CVE record

CVSS 8.8 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 17 Jul 2023
CVE-2023-33011 CVE record

CVSS 8.8 High

Uncontrolled format string in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 17 Jul 2023
CVE-2023-28767 CVE record

CVSS 8.8 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 17 Jul 2023
CVE-2023-33010 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 24 May 2023
CVE-2023-33009 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 24 May 2023
CVE-2023-28771 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

OS command injection in Zyxel ZyWALL/USG series firmware and others
- Zyxel ZyWALL/USG series firmware
- Zyxel VPN series firmware
- Command injection
Not analysed yet 25 Apr 2023
CVE-2023-27991 CVE record

CVSS 8.8 High

OS command injection in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 24 Apr 2023
CVE-2023-27990 CVE record

CVSS 4.8 Medium

Cross-site scripting in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Cross-site scripting (XSS)
Not analysed yet 24 Apr 2023
CVE-2023-22918 CVE record

CVSS 6.5 Medium

Exposure of personal information in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Information disclosure
Not analysed yet 24 Apr 2023
CVE-2023-22917 CVE record

CVSS 7.5 High

Buffer overflow in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- Memory corruption
Not analysed yet 24 Apr 2023
CVE-2023-22916 CVE record

CVSS 8.1 High

Improper input validation in Zyxel ATP series firmware and others
- Zyxel ATP series firmware
- Zyxel USG FLEX series firmware
- CWE-20
Not analysed yet 24 Apr 2023
CVE-2023-22915 CVE record

CVSS 7.5 High

Buffer overflow in Zyxel USG FLEX series firmware and others
- Zyxel USG FLEX series firmware
- Zyxel USG FLEX 50(W) firmware
- Memory corruption
Not analysed yet 24 Apr 2023
CVE-2023-22914 CVE record

CVSS 7.2 High

Path traversal in Zyxel USG FLEX series firmware and others
- Zyxel USG FLEX series firmware
- Zyxel VPN series firmware
- Path traversal
Not analysed yet 24 Apr 2023
CVE-2023-22913 CVE record

CVSS 8.1 High

Command injection in Zyxel USG FLEX series firmware and others
- Zyxel USG FLEX series firmware
- Zyxel VPN series firmware
- Command injection
Not analysed yet 24 Apr 2023
CVE-2022-38547 CVE record

CVSS 7.2 High

OS command injection in Zyxel ZyWALL/USG series firmware and others
- Zyxel ZyWALL/USG series firmware
- Zyxel VPN series firmware
- Command injection
Not analysed yet 7 Feb 2023
CVE-2022-40603 CVE record

CVSS 4.7 Medium

Cross-site scripting in Zyxel ZyWALL/USG series firmware and others
- Zyxel ZyWALL/USG series firmware
- Zyxel VPN series firmware
- Cross-site scripting (XSS)
Not analysed yet 6 Dec 2022
CVE-2022-26532 CVE record

CVSS 7.8 High

Argument injection in Zyxel USG/ZyWALL series firmware and others
- Zyxel USG/ZyWALL series firmware
- Zyxel USG FLEX series firmware
- Command injection
Not analysed yet 24 May 2022
CVE-2022-0910 CVE record

CVSS 6.5 Medium

Improper authentication in Zyxel USG/ZyWALL series firmware and others
- Zyxel USG/ZyWALL series firmware
- Zyxel USG FLEX series firmware
- Authentication bypass
Not analysed yet 24 May 2022
CVE-2022-0734 CVE record

CVSS 5.8 Medium

Cross-site scripting in Zyxel USG/ZyWALL series firmware and others
- Zyxel USG/ZyWALL series firmware
- Zyxel USG FLEX series firmware
- Cross-site scripting (XSS)
Not analysed yet 24 May 2022
CVE-2022-26531 CVE record

CVSS 6.1 Medium

Improper input validation in Zyxel USG/ZyWALL series firmware and others
- Zyxel USG/ZyWALL series firmware
- Zyxel USG FLEX series firmware
- CWE-20
Not analysed yet 24 May 2022
CVE-2022-0342 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Improper authentication in Zyxel USG/ZyWALL series firmware and others
- Zyxel USG/ZyWALL series firmware
- Zyxel USG FLEX series firmware
- Authentication bypass
Not analysed yet 28 Mar 2022
CVE-2021-35029 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper authentication in Zyxel USG/Zywall series Firmware and others
- Zyxel USG/Zywall series Firmware
- Zyxel USG FLEX series Firmware
- Authentication bypass
Not analysed yet 2 Jul 2021