Zyxel Usg 20w Firmware vulnerabilities

5 CVEs affecting Zyxel Usg 20w Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-26532, published 2022-05-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-0734, published 2022-05-24. Medium severity, CVSS 6.1. EPSS: 9.4% chance of exploitation in the next 30 days. A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series…
CVE-2022-26531, published 2022-05-24. High severity, CVSS 7.8. EPSS: 6.2% chance of exploitation in the next 30 days. Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP…
CVE-2022-26532, published 2022-05-24. High severity, CVSS 7.8. EPSS: 4.8% chance of exploitation in the next 30 days. A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series…
CVE-2018-9129, published 2018-08-15. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
CVE-2022-0910, published 2022-05-24. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware…