CVE-2020-29299: Command Injection
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-29299?
CVE-2020-29299 is a vulnerability that allows command injection by an admin via an input string to chg_exp_pwd during a password-change action.
Which Zyxel products are affected by CVE-2020-29299?
Zyxel VPN On-premise (before ZLD V4.39 week38), VPN Orchestrator (before SD-OS V10.03 week32), USG (before ZLD V4.39 week38), and USG FLEX (before ZLD V4.55 week38) are affected by CVE-2020-29299.
What is the severity of CVE-2020-29299?
The severity of CVE-2020-29299 is critical with a severity score of 7.2.
How can I fix CVE-2020-29299?
To fix CVE-2020-29299, it is recommended to apply the necessary patches and updates provided by Zyxel.
Where can I find more information about CVE-2020-29299?
More information about CVE-2020-29299 can be found on the Zyxel support website and the Zyxel security advisories page.