CVE-2021-35029 Auth bypass in ATP series Firmware
Remote attackers can bypass authentication in Zyxel USG/Zywall and related series firmware to execute arbitrary commands on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35029?
CVE-2021-35029 is a critical authentication bypass vulnerability in Zyxel ATP series Firmware, published on 2 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.
Weakness: CWE-287
Which versions are affected by CVE-2021-35029?
It affects 37 products.
Products include Zyxel Usg1000 Firmware, Zyxel Usg100 Firmware, Zyxel Usg1100 Firmware, Zyxel Usg110 Firmware, Zyxel Usg1900 Firmware, Zyxel Usg20-Vpn Firmware and 31 more.
How do I fix CVE-2021-35029?
No fix has been published for CVE-2021-35029 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-35029 being exploited?
There is no known exploitation of CVE-2021-35029 in the wild and no public exploit code.
Sources
Also known as GHSA-2h44-x2fr-537p.