CVE-2020-25014: Buffer Overflow
First published: Fri Nov 27 2020(Updated: )
A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel Zld Firmware | >=4.30<=4.55 | |
| Zyxel Zywall 110 | ||
| Zyxel Zywall 1100 | ||
| Zyxel Zywall 310 | ||
| Zyxel Usg 110 | ||
| Zyxel Usg 1100 | ||
| Zyxel Usg 1900 | ||
| Zyxel Usg 20w | ||
| Zyxel Usg 20w-vpn | ||
| Zyxel Usg 2200-vpn | ||
| Zyxel Usg 310 | ||
| Zyxel Usg 40 | ||
| Zyxel Usg 40w | ||
| Zyxel Usg 60 | ||
| Zyxel Usg 60w | ||
| Zyxel Usg110 | ||
| Zyxel Usg1100 | ||
| Zyxel Usg1900 | ||
| Zyxel Usg20-vpn | ||
| Zyxel Usg20w-vpn | ||
| Zyxel Usg210 | ||
| Zyxel Usg2200-vpn | ||
| Zyxel Usg310 | ||
| Zyxel Usg40 | ||
| Zyxel Usg40w | ||
| Zyxel Usg60 | ||
| Zyxel Usg60w | ||
| Zyxel Vpn100 | ||
| Zyxel Vpn300 | ||
| Zyxel Vpn50 | ||
| Zyxel Usg Flex 100 | ||
| Zyxel Usg Flex 200 | ||
| Zyxel Usg Flex 500 | ||
| Zyxel Usg Flex 100w | ||
| Zyxel Usg Flex 700 | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa1123-ac Hd | ||
| Zyxel Nwa1123-ac Pro | ||
| Zyxel Access Points Firmware | ||
| Zyxel Nwa1123-acv2 | ||
| Zyxel Wax510d | ||
| Zyxel Wac5302d-s | ||
| Zyxel Nwa5120 | ||
| Zyxel Nwa5301-nj | ||
| Zyxel Wax610d | ||
| Zyxel Wax650s | ||
| Zyxel Wac6550 | ||
| Zyxel Wac6303d-s | ||
| Zyxel Wac6500 | ||
| Zyxel Wac6100 | ||
| Zyxel Nwa210ax | ||
| Zyxel NWA110AX | ||
| Zyxel Nwa1302-ac | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Zywall 110 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Zywall 1100 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Zywall 310 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 110 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 1100 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 1900 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 20w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 20w-vpn | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 2200-vpn | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 310 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 40 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 40w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 60 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg 60w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg110 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg1100 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg1900 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg20-vpn | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg20w-vpn | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg210 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg2200-vpn | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg310 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg40 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg40w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg60 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg60w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Vpn100 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Vpn300 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Vpn50 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg Flex 100 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg Flex 200 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg Flex 500 | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg Flex 100w | ||
| All of | ||
| Zyxel Zld | >=4.30<=4.55 | |
| Zyxel Usg Flex 700 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa1123-ac Hd | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa1123-ac Pro | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | ||
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa1123-acv2 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wax510d | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wac5302d-s | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa5120 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa5301-nj | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wax610d | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wax650s | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wac6550 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wac6303d-s | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wac6500 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Wac6100 | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa210ax | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel NWA110AX | ||
| All of | ||
| Any of | ||
| Zyxel Access Points Firmware | <=6.10 | |
| Zyxel Access Points Firmware | =6.10 | |
| Zyxel Access Points Firmware | =6.10-patch1 | |
| Zyxel Access Points Firmware | =6.10-patch2 | |
| Zyxel Access Points Firmware | =6.10-patch3 | |
| Zyxel Access Points Firmware | =6.10-patch4 | |
| Zyxel Access Points Firmware | =6.10-patch5 | |
| Zyxel Access Points Firmware | =6.10-patch6 | |
| Zyxel Access Points Firmware | =6.10-patch7 | |
| Zyxel Nwa1302-ac |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-25014?
CVE-2020-25014 is a stack-based buffer overflow vulnerability found in the Zyxel UTM and VPN series of gateways firmware version V4.30 through to V4.55.
How severe is CVE-2020-25014?
CVE-2020-25014 has a severity rating of 9.8 (critical).
How can remote unauthenticated attackers exploit CVE-2020-25014?
Remote unauthenticated attackers can exploit CVE-2020-25014 by sending a crafted HTTP packet, which can allow them to execute arbitrary code.
Which Zyxel devices are affected by CVE-2020-25014?
Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 are affected by CVE-2020-25014.
How can I fix CVE-2020-25014?
To fix CVE-2020-25014, Zyxel has released a security advisory and patches that should be applied to the affected devices. Please refer to the Zyxel support website for more information.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/zyxel
- canonical/zyxel zld firmware
- version/zyxel zld firmware/4.30
- version/zyxel zld firmware/4.55
- canonical/zyxel zywall 110
- canonical/zyxel zywall 1100
- canonical/zyxel zywall 310
- canonical/zyxel usg 110
- canonical/zyxel usg 1100
- canonical/zyxel usg 1900
- canonical/zyxel usg 20w
- canonical/zyxel usg 20w-vpn
- canonical/zyxel usg 2200-vpn
- canonical/zyxel usg 310
- canonical/zyxel usg 40
- canonical/zyxel usg 40w
- canonical/zyxel usg 60
- canonical/zyxel usg 60w
- canonical/zyxel usg110
- canonical/zyxel usg1100
- canonical/zyxel usg1900
- canonical/zyxel usg20-vpn
- canonical/zyxel usg20w-vpn
- canonical/zyxel usg210
- canonical/zyxel usg2200-vpn
- canonical/zyxel usg310
- canonical/zyxel usg40
- canonical/zyxel usg40w
- canonical/zyxel usg60
- canonical/zyxel usg60w
- canonical/zyxel vpn100
- canonical/zyxel vpn300
- canonical/zyxel vpn50
- canonical/zyxel usg flex 100
- canonical/zyxel usg flex 200
- canonical/zyxel usg flex 500
- canonical/zyxel usg flex 100w
- canonical/zyxel usg flex 700
- canonical/zyxel access points firmware
- version/zyxel access points firmware/6.10
- version/zyxel access points firmware/6.10-patch1
- version/zyxel access points firmware/6.10-patch2
- version/zyxel access points firmware/6.10-patch3
- version/zyxel access points firmware/6.10-patch4
- version/zyxel access points firmware/6.10-patch5
- version/zyxel access points firmware/6.10-patch6
- version/zyxel access points firmware/6.10-patch7
- canonical/zyxel nwa1123-ac hd
- canonical/zyxel nwa1123-ac pro
- canonical/zyxel nwa1123-acv2
- canonical/zyxel wax510d
- canonical/zyxel wac5302d-s
- canonical/zyxel nwa5120
- canonical/zyxel nwa5301-nj
- canonical/zyxel wax610d
- canonical/zyxel wax650s
- canonical/zyxel wac6550
- canonical/zyxel wac6303d-s
- canonical/zyxel wac6500
- canonical/zyxel wac6100
- canonical/zyxel nwa210ax
- canonical/zyxel nwa110ax
- canonical/zyxel nwa1302-ac
- canonical/zyxel zld
- version/zyxel zld/4.30
- version/zyxel zld/4.55