CVE-2021-35029 — CRITICAL (9.8)

Q: How severe is CVE-2021-35029?

CVE-2021-35029 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2021-35029?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Usg1900 Firmware, Zyxel Usg1900, Zyxel Usg1100 Firmware, Zyxel Usg1100, Zyxel Usg310 Firmware.

Vulnerability Description

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Zyxel	Usg1900 Firmware	>= 4.35, <= 4.64
Zyxel	Usg1900	-
Zyxel	Usg1100 Firmware	>= 4.35, <= 4.64
Zyxel	Usg1100	-
Zyxel	Usg310 Firmware	>= 4.35, <= 4.64
Zyxel	Usg310	-
Zyxel	Usg210 Firmware	>= 4.35, <= 4.64
Zyxel	Usg210	-
Zyxel	Usg110 Firmware	>= 4.35, <= 4.64
Zyxel	Usg110	-
Zyxel	Usg40 Firmware	>= 4.35, <= 4.64
Zyxel	Usg40	-
Zyxel	Usg40W Firmware	>= 4.35, <= 4.64
Zyxel	Usg40W	-
Zyxel	Usg60 Firmware	>= 4.35, <= 4.64
Zyxel	Usg60	-
Zyxel	Usg60W Firmware	>= 4.35, <= 4.64
Zyxel	Usg60W	-
Zyxel	Usg300 Firmware	>= 4.35, <= 4.64
Zyxel	Usg300	-

Related Weaknesses (CWE)

CWE-287

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_securiVendor Advisory
https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_securiVendor Advisory

FAQ

What is CVE-2021-35029?

CVE-2021-35029 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 th...

How severe is CVE-2021-35029?

CVE-2021-35029 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-35029?

Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Usg1900 Firmware, Zyxel Usg1900, Zyxel Usg1100 Firmware, Zyxel Usg1100, Zyxel Usg310 Firmware.