GCVE - cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Zyxel (`d3fcf896-5708-55f8-8f74-3e19a9d55b89`)
Product	Usg2200 Vpn (`8ee7cf2d-d321-54c3-8592-12c24bd6935a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-35029`	not_vulnerable	2026-06-08 05:32:17.442097	Details available CRITICAL (9.8) An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device. Published: 2021-07-02T10:29:07.000Z Updated: 2024-08-04T00:33:49.831Z Open on db.gcve.eu Reference links https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-25014`	not_vulnerable	2026-06-08 05:22:35.828181	Details available A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet. Published: 2020-11-27T17:18:30.000Z Updated: 2024-08-04T15:26:09.045Z Open on db.gcve.eu Reference links https://businessforum.zyxel.com/categories/security-news-and-release https://www.zyxel.com/support/Zyxel-security-advisory-for-buffer-overflow-vulnerability.shtml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9955`	not_vulnerable	2026-06-08 05:14:26.706999	Details available On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter. Published: 2019-04-22T19:38:59.000Z Updated: 2024-08-04T22:10:08.670Z Open on db.gcve.eu Reference links https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page http://seclists.org/fulldisclosure/2019/Apr/22 https://www.exploit-db.com/exploits/46706/ http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12583`	not_vulnerable	2026-06-08 05:12:39.358689	Details available Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service. Published: 2019-06-27T14:01:02.000Z Updated: 2024-08-04T23:24:39.316Z Open on db.gcve.eu Reference links https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12581`	not_vulnerable	2026-06-08 05:12:39.357492	Details available A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter. Published: 2019-06-27T14:10:08.000Z Updated: 2024-08-04T23:24:39.189Z Open on db.gcve.eu Reference links https://www.zyxel.com/us/en/ https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.