What’s Vulnerable › Vulnerabilities

CVE-2020-29299

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-27 · updated 2026-06-17
• Weakness: CWE-77

Description

Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.

Affected products

• Zyxel Nsg Firmware: before 1.33; 1.33, 1.33-patch1 — fixed in 1.33
• Zyxel Usg Flex Firmware: all versions
• Zyxel Vpn Orchestrator: before 10.03 — fixed in 10.03
• Zyxel firewall (ZLD): before 4.39; before 4.55 — fixed in 4.39, 4.55

How to fix

Upgrade to a fixed version: Zyxel Nsg Firmware 1.33; Zyxel Vpn Orchestrator 10.03; Zyxel firewall (ZLD) 4.39, 4.55. Check the vendor advisory for mitigations.

References

• https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml
• https://www.zyxel.com/us/en/support/security_advisories.shtml
• https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml
• https://www.zyxel.com/us/en/support/security_advisories.shtml

Get alerted when CVE-2020-29299 or the next vulnerability affects your stack