CVE-2021-35029

Published: Jul 2, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

Affected (37)

Products: Zyxel: Usg1900 Firmware, Usg1100 Firmware, Usg310 Firmware, Usg210 Firmware, Usg110 Firmware, Usg40 Firmware, Usg40w Firmware, Usg60 Firmware, Usg60w Firmware, Usg300 Firmware, Usg1000 Firmware, Usg2000 Firmware, Usg20 Firmware, Usg20w Firmware, Usg50 Firmware, Usg100 Firmware, Usg200 Firmware, Usg Flex 100 Firmware, Usg Flex 200 Firmware, Usg Flex 500 Firmware, Usg Flex 100w Firmware, Usg Flex 700 Firmware, Zywall Atp100 Firmware, Zywall Atp100w Firmware, Zywall Atp200 Firmware, Zywall Atp500 Firmware, Zywall Atp700 Firmware, Zywall Atp800 Firmware, Zywall Vpn50 Firmware, Zywall Vpn100 Firmware, Zywall Vpn300 Firmware, Usg20 Vpn Firmware, Usg20w Vpn Firmware, Usg2200 Vpn Firmware, Zywall 110 Firmware, Zywall 310 Firmware, Zywall 1100 Firmware

37 products

Usg Flex 100 Firmware

Usg Flex 200 Firmware

Usg Flex 500 Firmware

Usg Flex 100w Firmware

Usg Flex 700 Firmware

Zywall Atp100 Firmware

Zywall Atp100w Firmware

Zywall Atp200 Firmware

Zywall Atp500 Firmware

Zywall Atp700 Firmware

Zywall Atp800 Firmware

Zywall Vpn50 Firmware

Zywall Vpn100 Firmware

Zywall Vpn300 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg1900 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg1900	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg1100 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg1100	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg310 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg310	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg210 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg210	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg110 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg110	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg40 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg40	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg40w Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg40w	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg60 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg60	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg60w Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg60w	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg300 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg300	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg1000 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg1000	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg2000 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg2000	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg20	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20w Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg20w	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg50 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg50	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg100 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg100	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg200 Firmware	From 4.35 to 4.64

Running on/with	Platform Versions
Zyxel Usg200	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 100 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg Flex 100	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 200 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg Flex 200	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 500 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg Flex 500	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 100w Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg Flex 100w	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 700 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg Flex 700	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp100 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp100	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp100w Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp100w	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp200 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp200	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp500 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp500	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp700 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp700	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Atp800 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Atp800	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Vpn50 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Vpn50	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Vpn100 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Vpn100	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall Vpn300 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall Vpn300	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20 Vpn Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg20 Vpn	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20w Vpn Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg20w Vpn	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg2200 Vpn Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Usg2200 Vpn	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 110 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall 110	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 310 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall 310	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 1100 Firmware	From 4.35 to 5.01

Running on/with	Platform Versions
Zyxel Zywall 1100	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml

Source: security@zyxel.com.tw

Vendor Advisory

https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.