High · 7.3 CVE-2021-35028 EUVD-2021-21675GHSA-qfm3-mj8g-3hm7

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to e…

Published Sep 29, 2021 · Updated Aug 4, 2024 · Assigned by Zyxel

Vendor: Zyxel Product: ZyWALL VPN2S Firmware Category: Network devices

Description

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

Affected products

Vendor	Product	Affected	Fixed
Zyxel	ZyWALL VPN2S Firmware	1.12(ABLN.0)C0	—

References

https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_VPN2S_Firewall.shtml