High · published October 21, 2025
⚡ An authenticated admin can execute arbitrary OS commands just by sending a sneaky string! It's like giving a trusted chef the ability to create anything in the kitchen, but leaving the backdoor wide open. 🔥 Imagine a restaurant where a chef can cook any dish they want, but the restaurant manager forgot to check the menu. With a crafted string, the chef could whip up something utterly disastrous instead of just the ordered meals! This vulnerability could allow an admin to execute any command on the device's operating system, potentially leading to unauthorized access, data exposure, or service disruptions. An attacker could compromise the integrity and availability of the system with just a cleverly crafted input.
Imagine a restaurant where a chef can cook any dish they want, but the restaurant manager forgot to check the menu. With a crafted string, the chef could whip up something utterly disastrous instead of just the ordered meals! This post-authentication command injection vulnerability exists in Zyxel ATP and USG FLEX series firmware, enabling attackers with admin privileges to pass malicious strings directly to the command line interface (CLI), thereby executing system commands.
This vulnerability could allow an admin to execute any command on the device's operating system, potentially leading to unauthorized access, data exposure, or service disruptions. An attacker could compromise the integrity and availability of the system with just a cleverly crafted input. Upgrade affected devices to the latest firmware versions: V5.41 or higher for ATP series, USG FLEX series, and USG20(W)-VPN series. Review and limit admin privileges where possible, and monitor for any unusual command executions in the logs. You've got this! With these steps, you'll patch the vulnerability and tighten up your defenses in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zyxel/zld | ≥ 4.32, < 5.41 | 5.41 |
| zyxel/zld | ≥ 4.50, < 5.41 | 5.41 |
| zyxel/zld | ≥ 4.16, < 5.41 | 5.41 |