Zyxel Zywall Usg 100 Firmware vulnerabilities

2 CVEs affecting Zyxel Zywall Usg 100 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28771, published 2023-04-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-28771: Zyxel Multiple Firewalls OS Command Injection Vulnerability, published 2023-04-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-31. EPSS: 99.3% chance of exploitation in the next 30 days. Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35,…
CVE-2017-17550, published 2018-11-10. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently…