What’s Vulnerable › Vulnerabilities

CVE-2020-25014

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-27 · updated 2026-06-17
• Weakness: CWE-787

Description

A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.

Affected products

• Zyxel Access Points Firmware: through 6.10; 6.10, 6.10-patch1, 6.10-patch2, 6.10-patch3, 6.10-patch4, 6.10-patch5 (+2)
• Zyxel firewall (ZLD): from 4.30 through 4.55

References

• https://businessforum.zyxel.com/categories/security-news-and-release
• https://www.zyxel.com/support/Zyxel-security-advisory-for-buffer-overflow-vulnerability.shtml
• https://businessforum.zyxel.com/categories/security-news-and-release
• https://www.zyxel.com/support/Zyxel-security-advisory-for-buffer-overflow-vulnerability.shtml

Get alerted when CVE-2020-25014 or the next vulnerability affects your stack