CVE-2022-265316.1MediumCWE-20

CVE-2022-26531: Zyxel USG/ZyWALL series firmware vulnerability

Zyxel · USG/ZyWALL series firmware

Affected: Zyxel USG/ZyWALL series firmware · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

6.4%probability of exploitation in the next 30 days

93rd percentile

050100

Higher than 93% of scored CVEs

6.1MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

Affected products10

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Zyxel · USG/ZyWALL series firmware4.09 through 4.71
Zyxel · USG FLEX series firmware4.50 through 5.21
Zyxel · ATP series firmware4.32 through 5.21
Zyxel · VPN series firmware4.30 through 5.21
Zyxel · NSG series firmware1.00 through 1.33 Patch 4
Zyxel · NXC2500 firmware<= 6.10(AAIG.3)
Zyxel · NAP203 firmware<= 6.25(ABFA.7)
Zyxel · NWA50AX firmware<= 6.25(ABYW.5)
Zyxel · WAC500 firmware<= 6.30(ABVS.2)
Zyxel · WAX510D firmware<= 6.30(ABTF.2)

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Input Validation · Input Validation and Logic
Vendor: Zyxel
Published: May 2022
Band: Possible (1 to 10%), May 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-26531 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.