Zyxel NBG6604 Firmware vulnerabilities

4 CVEs affecting Zyxel NBG6604 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33013, published 2023-08-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33013, published 2023-08-14. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an authenticated attacker to execute some OS commands remotely…
CVE-2023-22919, published 2023-05-01. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a…
CVE-2021-35034, published 2021-12-29. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.
CVE-2021-35035, published 2021-12-29. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file.