CVE PROGRAM SOURCE RECORD7.3 High

CVE-2021-35028

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

Status: Published
Published: 2021-09-29
Updated: 2024-08-04
Assigning organization: Zyxel

Description

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zyxel ZyWALL VPN2S Firmware

1.12(ABLN.0)C0affected

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_VPN2S_Firewall.shtml ↗