[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN5PEVbfj-9zLJhEawaXdYYZreHQmP3c_x_9Ww94HFxI":3,"g5a-family:zyxel\u002Fusg_flex_100ax":94,"g5a-ex:zyxel\u002Fusg_flex_100ax@*":98},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":66,"seoMetadata":72,"meta":91},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"zyxel","usg_flex_100ax",0,14,1,"2025-10-21",[],"Usg Flex 100ax by Zyxel is a technology product and 14 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,31,36,41,44,47,52,56,60],{"cveId":18,"description":19,"publishedDate":12,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":24},"CVE-2025-9133","A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device.",8.1,"v3.1","High",false,0.05462,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":21,"severity":22,"isKev":4,"epssScore":30},"CVE-2024-11667","A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.","2024-11-27",7.5,0.03017,{"cveId":32,"description":33,"publishedDate":12,"cvssScore":34,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":35},"CVE-2025-8078","A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command.",7.2,0.01484,{"cveId":37,"description":38,"publishedDate":39,"cvssScore":34,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":40},"CVE-2024-42059","A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP.","2024-09-03",0.01339,{"cveId":42,"description":43,"publishedDate":39,"cvssScore":34,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":40},"CVE-2024-42060","A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device.",{"cveId":45,"description":46,"publishedDate":39,"cvssScore":34,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":40},"CVE-2024-7203","A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device by executing a crafted CLI command.",{"cveId":48,"description":49,"publishedDate":50,"cvssScore":34,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":51},"CVE-2023-6398","A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, \n\nUSG FLEX H series firmware versions from 1.10 through 1.10 Patch 1,\n\nNWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP.","2024-02-20",0.01333,{"cveId":53,"description":54,"publishedDate":39,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":55},"CVE-2024-42057","A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device. Note that this attack could be successful only if the device was configured in User-Based-PSK authentication mode and a valid user with a long username exceeding 28 characters exists.",0.0132,{"cveId":57,"description":58,"publishedDate":50,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":59},"CVE-2023-6764","\n\n\n\n\n\n\n\n\n\n\n\nA format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.\n\n\n\n",0.00889,{"cveId":61,"description":62,"publishedDate":50,"cvssScore":63,"cvssVersion":21,"severity":64,"isKev":23,"epssScore":65},"CVE-2023-6399","A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled.",5.7,"Medium",0.00649,[67],{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"severity":22,"isKev":4,"epssScore":30,"cisaVulnName":68,"cisaDateAdded":69,"cisaShortDescription":70,"cisaRequiredAction":71},"Zyxel Multiple Firewalls Path Traversal Vulnerability","2024-12-03","Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":73,"metaDescription":74,"keywords":75,"structuredData":76},"Usg Flex 100ax by Zyxel - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Usg Flex 100ax by Zyxel with 14 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Usg Flex 100ax vulnerabilities, Usg Flex 100ax security, Usg Flex 100ax CVE, Zyxel Usg Flex 100ax, Usg Flex 100ax threat intelligence, Zyxel security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Usg Flex 100ax KEV, Usg Flex 100ax exploited vulnerabilities",{"@context":77,"@type":78,"name":79,"description":74,"url":80,"manufacturer":81,"applicationCategory":85,"softwareVersion":86,"mainEntity":87},"https:\u002F\u002Fschema.org","SoftwareApplication","Usg Flex 100ax","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fzyxel\u002Fusg_flex_100ax",{"@type":82,"name":83,"url":84},"Organization","Zyxel","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fzyxel","Security Software","Multiple versions",{"@type":88,"name":89,"description":90,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Usg Flex 100ax Security Vulnerabilities","Security vulnerabilities affecting Usg Flex 100ax by Zyxel",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":92,"apiVersion":93},"2026-10-28T18:21:26.470Z","3.0",[95],{"product":96,"cves":97},"usg_flex_100ax_firmware",4,{"rows":99,"total":11,"capped":23,"failed":9},[100],{"cveId":26,"name":68,"severity":22,"cvss":29,"added":69,"epss":30,"published":101,"ranges":102,"checked":4,"hits":103,"covers":23},"2024-11-27T10:15:04.21",[],[]]