USG20(W)-VPN series firmware vulnerabilities | LiveThreat CVE Feed

Product

USG20(W)-VPN series firmware

by Zyxel · last CVE Aug 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities28 In the news0 Timeline

Severity mix

Critical 1High 16Medium 11Low 0

Severity

All severities28 Critical1 High16 Medium11 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add USG20(W)-VPN series firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-11667 RansomwareIn wildKEV	9.8	3%	Nov 27	Zyxel Multiple Firewalls Path Traversal Vulnerability Affected: versions V5.10 through V5.38
CVE-2023-33012	8.8	10%	Jul 17	A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through… Affected: 5.10 through 5.36 Patch 2
CVE-2023-33011	8.8	0%	Jul 17	A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W)… Affected: 5.10 through 5.36 Patch 2
CVE-2023-28767	8.8	0%	Jul 17	The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, … Affected: 5.10 through 5.36
CVE-2025-9133	8.1	5%	Oct 21	A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W)… Affected: versions from V4.16 through V5.40
CVE-2024-42057	8.1	1%	Sep 3	A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through… Affected: versions V4.16 through V5.38
CVE-2023-6764	8.1	1%	Feb 20	A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from… Affected: version 4.16 through 5.37 Patch 1
CVE-2023-34141	8.0	1%	Jul 17	A command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, USG FLEX series firmware… Affected: 5.00 through 5.36 Patch 2
CVE-2023-34138	8.0	1%	Jul 17	A command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX series firmware versions 4.60… Affected: 4.60 through 5.36 Patch 2
CVE-2024-42058	7.5	1%	Sep 3	A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W)… Affected: versions V5.20 through V5.38
CVE-2023-4398	7.5	1%	Nov 28	An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX… Affected: versions 4.16 through 5.37
CVE-2026-14818	7.2	1%	Aug 4	A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series… Affected: from V4.16 through V5.42 Patch 1
CVE-2025-11730	7.2	1%	Feb 5	A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 through V5.41, USG FLEX… Affected: versions from V5.35 through V5.41
CVE-2025-8078	7.2	1%	Oct 21	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40,… Affected: versions from V4.16 through V5.40
CVE-2024-42060	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38,… Affected: versions V4.16 through V5.38
CVE-2024-42059	7.2	1%	Sep 3	A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38,… Affected: versions V5.00 through V5.38
CVE-2023-6398	7.2	1%	Feb 20	A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware… Affected: version 4.16 through 5.37 Patch 1
CVE-2023-6399	6.5	1%	Feb 20	A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX… Affected: version 4.16 through 5.37 Patch 1
CVE-2023-34140	6.5	0%	Jul 17	A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5.36 Patch 2, USG FLEX 50(W)… Affected: 4.16 through 5.36 Patch 2
CVE-2024-42061	6.1	0%	Sep 3	A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series… Affected: versions V4.16 through V5.38
CVE-2023-35139	6.1	0%	Nov 28	A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.37, USG FLEX series firmware versions 5.00 through 5.37, USG… Affected: versions 5.10 through 5.37
CVE-2023-5797	5.5	0%	Nov 28	An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through… Affected: versions 4.16 through 5.37
CVE-2023-5650	5.5	0%	Nov 28	An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG… Affected: versions 4.16 through 5.37
CVE-2023-37926	5.5	0%	Nov 28	A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware… Affected: versions 4.16 through 5.37
CVE-2023-37925	5.5	0%	Nov 28	An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through… Affected: versions 4.16 through 5.37
CVE-2023-35136	5.5	0%	Nov 28	An improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through… Affected: versions 4.16 through 5.37
CVE-2024-6343	4.9	1%	Sep 3	A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG… Affected: versions V4.16 through V5.38
CVE-2023-4397	4.4	0%	Nov 28	A buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series firmware version 5.37, USG FLEX 50(W) series firmware version 5.37, and USG20(W)-VPN… Affected: 5.37