Vulnerabilities > Zyxel

DATE CVE VULNERABILITY TITLE RISK
2019-05-02 CVE-2017-18374 Use of Hard-coded Credentials vulnerability in multiple products
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true.
network
low complexity
billion zyxel CWE-798
critical
9.0
2019-05-02 CVE-2017-18372 OS Command Injection vulnerability in multiple products
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user.
network
low complexity
billion zyxel CWE-78
critical
9.0
2019-05-02 CVE-2017-18371 Use of Hard-coded Credentials vulnerability in multiple products
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234.
network
low complexity
billion zyxel CWE-798
7.5
2019-05-02 CVE-2017-18370 OS Command Injection vulnerability in multiple products
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user.
network
low complexity
billion zyxel CWE-78
critical
9.0
2019-05-02 CVE-2017-18368 OS Command Injection vulnerability in multiple products
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user.
network
low complexity
billion zyxel CWE-78
critical
10.0
2019-04-22 CVE-2019-9955 Cross-site Scripting vulnerability in Zyxel products
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
network
zyxel CWE-79
4.3
2019-04-09 CVE-2019-10634 Cross-site Scripting vulnerability in Zyxel Nas326 Firmware
An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.
network
zyxel CWE-79
3.5
2019-04-09 CVE-2019-10633 Code Injection vulnerability in Zyxel Nas326 Firmware
An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.
network
low complexity
zyxel CWE-94
6.5
2019-04-09 CVE-2019-10632 Path Traversal vulnerability in Zyxel Nas326 Firmware
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.
network
low complexity
zyxel CWE-22
4.0
2019-04-09 CVE-2019-10631 OS Command Injection vulnerability in Zyxel Nas326 Firmware
Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
network
low complexity
zyxel CWE-78
6.5