CVE-2021-35028: Zyxel Zywall VPN2S Firmware

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

Affected products

• Zyxel Zywall VPN2S Firmware: version 1.12(abln.0)c0 only

Published 2021-09-29. Last modified 2026-06-17.