GCVE - cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Zyxel (`d3fcf896-5708-55f8-8f74-3e19a9d55b89`)
Product	Usg Flex 200H Firmware (`560791e6-7084-56f3-b20e-fe5138c6e82d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-9677`	vulnerable	2026-06-08 07:00:28.514022	Details available MEDIUM (5.5) The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out. Published: 2024-10-22T01:19:53.188Z Updated: 2024-10-22T15:52:56.281Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7203`	vulnerable	2026-06-08 06:58:21.495602	Details available HIGH (7.2) A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device by executing a crafted CLI command. Published: 2024-09-03T01:36:32.110Z Updated: 2024-09-03T13:55:28.588Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42060`	vulnerable	2026-06-08 06:43:56.098549	Details available HIGH (7.2) A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. Published: 2024-09-03T01:54:57.221Z Updated: 2024-09-03T13:43:44.353Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42059`	vulnerable	2026-06-08 06:43:56.090234	Details available HIGH (7.2) A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP. Published: 2024-09-03T01:51:20.796Z Updated: 2024-09-03T13:53:11.888Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42058`	vulnerable	2026-06-08 06:43:56.087081	Details available HIGH (7.5) A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device. Published: 2024-09-03T01:47:29.258Z Updated: 2024-09-03T13:54:13.924Z Open on db.gcve.eu Reference links https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-42057`	vulnerable	2026-06-08 06:43:56.058159	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-11667`	vulnerable	2026-06-08 06:23:50.132529	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6764`	vulnerable	2026-06-08 06:21:55.725322	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6399`	vulnerable	2026-06-08 06:19:47.205757	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6398`	vulnerable	2026-06-08 06:19:47.175905	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6397`	vulnerable	2026-06-08 06:19:47.145963	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.