CVE-2022-26531
Description
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.
How to fix
- zyxel nsg300_firmware1.33 or later
- zyxel nsg100_firmware1.33 or later
- zyxel nsg50_firmware1.33 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel nxc2500_firmware | v ≤ 6.10\(aaig.3\) | — |
| zyxel vpn100_firmware | 4.30 ≤ v ≤ 5.21 | — |
| zyxel vpn1000_firmware | 4.30 ≤ v ≤ 5.21 | — |
| zyxel vpn300_firmware | 4.30 ≤ v ≤ 5.21 | — |
| zyxel vpn50_firmware | 4.30 ≤ v ≤ 5.21 | — |
| zyxel atp100_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel atp100w_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel atp200_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel atp500_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel atp700_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel atp800_firmware | 4.32 ≤ v ≤ 5.21 | — |
| zyxel usg_110_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_1100_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_1900_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_20w_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_20w-vpn_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_2200-vpn_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_310_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_40_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_40w_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_60_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_60w_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg_flex_100_firmware | 4.50 ≤ v ≤ 5.21 | — |
| zyxel usg_flex_100w_firmware | 4.50 ≤ v ≤ 5.21 | — |
| zyxel usg_flex_200_firmware | 4.50 ≤ v ≤ 5.21 | — |
| zyxel usg_flex_500_firmware | 4.50 ≤ v ≤ 5.21 | — |
| zyxel usg_flex_700_firmware | 4.50 ≤ v ≤ 5.21 | — |
| zyxel usg200_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg20_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg210_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg2200_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg300_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel usg310_firmware | 4.09 ≤ v ≤ 4.71 | — |
| zyxel nsg300_firmware | 1.00 ≤ v < 1.33, 1.33 | 1.33 |
| zyxel nsg100_firmware | 1.00 ≤ v < 1.33, 1.33 | 1.33 |
| zyxel nsg50_firmware | 1.00 ≤ v < 1.33, 1.33 | 1.33 |
| zyxel nxc5500_firmware | v ≤ 6.10\(aaos.3\) | — |
| zyxel nap203_firmware | v ≤ 6.25\(abfa.7\) | — |
| zyxel nap303_firmware | v ≤ 6.25\(abex.7\) | — |
| zyxel nap353_firmware | v ≤ 6.25\(abey.7\) | — |
| zyxel nwa50ax_firmware | v ≤ 6.25\(abyw.5\) | — |
| zyxel nwa55axe_firmware | v ≤ 6.25\(abzl.5\) | — |
| zyxel nwa90ax_firmware | v ≤ 6.27\(accv.2\) | — |
| zyxel nwa110ax_firmware | v ≤ 6.30\(abtg.2\) | — |
| zyxel nwa210ax_firmware | v ≤ 6.30\(abtd.2\) | — |
| zyxel nwa1123-ac-hd_firmware | v ≤ 6.25\(abin.6\) | — |
| zyxel nwa1123-ac-pro_firmware | v ≤ 6.25\(abhd.7\) | — |
| zyxel nwa1123acv3_firmware | v ≤ 6.30\(abvt.2\) | — |
| zyxel nwa1302-ac_firmware | v ≤ 6.25\(abku.6\) | — |
| zyxel nwa5123-ac-hd_firmware | v ≤ 6.25\(abim.6\) | — |
| zyxel wac500h_firmware | v ≤ 6.30\(abwa.2\) | — |
| zyxel wac500_firmware | v ≤ 6.30\(abvs.2\) | — |
| zyxel wac5302d-s_firmware | v ≤ 6.10\(abfh.10\) | — |
| zyxel wac5302d-sv2_firmware | v ≤ 6.25\(abvz.6\) | — |
| zyxel wac6103d-i_firmware | v ≤ 6.25\(aaxh.7\) | — |
| zyxel wac6303d-s_firmware | v ≤ 6.25\(abgl.6\) | — |
| zyxel wac6502d-e_firmware | v ≤ 6.25\(aasd.7\) | — |
| zyxel wac6502d-s_firmware | v ≤ 6.25\(aase.7\) | — |
| zyxel wac6503d-s_firmware | v ≤ 6.25\(aasf.7\) | — |
| zyxel wac6553d-s_firmware | v ≤ 6.25\(aasg.7\) | — |
| zyxel wac6552d-s_firmware | v ≤ 6.25\(abio.7\) | — |
| zyxel wax510d_firmware | v ≤ 6.30\(abtf.2\) | — |
| zyxel wax610d_firmware | v ≤ 6.30\(abte.2\) | — |
| zyxel wax630s_firmware | v ≤ 6.30\(abzd.2\) | — |
| zyxel wax650s_firmware | v ≤ 6.30\(abrm.2\) | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.