PT-2021-20802 · Zyxel · Zyxel Usg Flex+3

Published 2021-07-02 · Updated 2021-07-08 · CVE-2021-35029

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zyxel USG/Zywall series firmware versions 4.35 through 4.64 Zyxel USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01

Description: An authentication bypass vulnerability in the web-based management interface could allow a remote attacker to execute arbitrary commands on an affected device.

Recommendations: For Zyxel USG/Zywall series firmware versions 4.35 through 4.64, update to a version outside of this range to resolve the issue. For Zyxel USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-35029

Affected Products

Zyxel Atp

Zyxel Usg Flex

Zyxel Usg/Zywall

Zyxel Vpn

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-35029 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35029 · Vendor Advisory
• https://zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml · Vendor Advisory
• https://t.me/cvenotify/16968 · Telegram Post
• https://t.me/cibsecurity/25886 · Telegram Post