CVE-2021-35029: Critical severity zyxel usg1900 firmware vulnerability

Q: What is the severity of CVE-2021-35029?

CVE-2021-35029 is classified as a critical authentication bypass vulnerability.

Q: How do I fix CVE-2021-35029?

To mitigate CVE-2021-35029, users should update their Zyxel devices to the latest firmware version that addresses the vulnerability.

Q: Which Zyxel products are affected by CVE-2021-35029?

CVE-2021-35029 affects various Zyxel USG and Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01.

Q: Can CVE-2021-35029 allow remote attacks?

Yes, CVE-2021-35029 allows remote attackers to execute arbitrary commands on affected devices.

Q: Is there a known exploit for CVE-2021-35029?

Yes, CVE-2021-35029 has been reported to be actively exploited, making prompt remediation essential.

Published Jul 2, 2021

Updated

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

Affected Software

74 affected components

Zyxel Usg1900 Firmware>=4.35<=4.64

Zyxel USG1900

Zyxel Usg1100 Firmware>=4.35<=4.64

Zyxel USG1100

Zyxel Usg310 Firmware>=4.35<=4.64

Zyxel USG310

Zyxel Usg210 Firmware>=4.35<=4.64

Zyxel USG210

Zyxel Usg110 Firmware>=4.35<=4.64

Zyxel USG110

Zyxel Usg40 Firmware>=4.35<=4.64

Zyxel USG40

Zyxel Usg40w Firmware>=4.35<=4.64

Zyxel USG40W

Zyxel Usg60 Firmware>=4.35<=4.64

Zyxel USG60

Zyxel Usg60w Firmware>=4.35<=4.64

Zyxel USG60W

Zyxel Usg300 Firmware>=4.35<=4.64

Zyxel Usg300

Zyxel Usg1000 Firmware>=4.35<=4.64

Zyxel Usg1000

Zyxel Usg2000 Firmware>=4.35<=4.64

Zyxel Usg2000

Zyxel Usg20 Firmware>=4.35<=4.64

Zyxel Usg20

Zyxel Usg20w Firmware>=4.35<=4.64

Zyxel Usg20w

Zyxel Usg50 Firmware>=4.35<=4.64

Zyxel USG50

Zyxel Usg100 Firmware>=4.35<=4.64

Zyxel Usg100

Zyxel Usg200 Firmware>=4.35<=4.64

Zyxel Usg200

Zyxel Usg Flex 100 Firmware>=4.35<=5.01

Zyxel Usg Flex 100

Zyxel USG FLEX 200 firmware>=4.35<=5.01

Zyxel USG FLEX 200

Zyxel USG FLEX 500 firmware>=4.35<=5.01

Zyxel USG FLEX 500

Zyxel Usg Flex 100w Firmware>=4.35<=5.01

Zyxel Usg Flex 100w

Zyxel USG FLEX 700 firmware>=4.35<=5.01

Zyxel USG FLEX 700

Zyxel Zywall Atp100 Firmware>=4.35<=5.01

Zyxel Zywall Atp100

Zyxel Zywall Atp100w Firmware>=4.35<=5.01

Zyxel Zywall Atp100w

Zyxel Zywall Atp200 Firmware>=4.35<=5.01

Zyxel Zywall Atp200

Zyxel Zywall Atp500 Firmware>=4.35<=5.01

Zyxel Zywall Atp500

Zyxel Zywall Atp700 Firmware>=4.35<=5.01

Zyxel Zywall Atp700

Zyxel Zywall Atp800 Firmware>=4.35<=5.01

Zyxel Zywall Atp800

Zyxel Zywall Vpn50 Firmware>=4.35<=5.01

Zyxel Zywall Vpn50

Zyxel Zywall Vpn100 Firmware>=4.35<=5.01

Zyxel Zywall Vpn100

Zyxel Zywall Vpn300 Firmware>=4.35<=5.01

Zyxel Zywall Vpn300

Zyxel Usg20-vpn Firmware>=4.35<=5.01

Zyxel USG20-VPN

Zyxel Usg20w-vpn Firmware>=4.35<=5.01

Zyxel USG20W-VPN

Zyxel Usg2200-vpn Firmware>=4.35<=5.01

Zyxel USG2200-VPN

Zyxel Zywall 110 Firmware>=4.35<=5.01

Zyxel ZyWALL 110

Zyxel Zywall 310 Firmware>=4.35<=5.01

Zyxel ZyWALL 310

Zyxel Zywall 1100 Firmware>=4.35<=5.01

Zyxel ZyWALL 1100

Event History

Jul 2, 2021

CVE Published

via MITRE·10:29 AM

Data Sourced

via MITRE·10:29 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-35029?

CVE-2021-35029 is classified as a critical authentication bypass vulnerability.

How do I fix CVE-2021-35029?

To mitigate CVE-2021-35029, users should update their Zyxel devices to the latest firmware version that addresses the vulnerability.

Which Zyxel products are affected by CVE-2021-35029?

CVE-2021-35029 affects various Zyxel USG and Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01.

Can CVE-2021-35029 allow remote attacks?

Yes, CVE-2021-35029 allows remote attackers to execute arbitrary commands on affected devices.

Is there a known exploit for CVE-2021-35029?