CVE-2022-26531

high-risk
Published 2022-05-24

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

Do I need to act?

-
0.99% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
LOCAL / LOW complexity

Affected Products (20)

Usg 110 Firmware
Usg 1100 Firmware
Usg 1900 Firmware
Usg 20W Firmware
Usg 20W-Vpn Firmware
Usg 2200-Vpn Firmware
Usg 310 Firmware

Affected Vendors

52
/ 100
high-risk
Severity 20/34 · Moderate
Exploitability 3/34 · Minimal
Exposure 29/34 · Critical