7.5

CVE-2024-42058

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zyxel ≫ Zld Version >= 4.32 < 5.39
   Zyxel ≫ Atp100 Version -
   Zyxel ≫ Atp100w Version -
   Zyxel ≫ Atp200 Version -
   Zyxel ≫ Atp500 Version -
   Zyxel ≫ Atp700 Version -
   Zyxel ≫ Atp800 Version -
Zyxel ≫ Zld Version >= 4.50 < 5.39
   Zyxel ≫ Usg Flex 100 Version -
   Zyxel ≫ Usg Flex 100ax Version -
   Zyxel ≫ Usg Flex 100w Version -
   Zyxel ≫ Usg Flex 200 Version -
   Zyxel ≫ Usg Flex 50 Version -
   Zyxel ≫ Usg Flex 500 Version -
   Zyxel ≫ Usg Flex 700 Version -
Zyxel ≫ Zld Version >= 4.20 < 5.39
   Zyxel ≫ Usg Flex 50w Version -
Zyxel ≫ Zld Version >= 4.20 < 5.39
   Zyxel ≫ Usg 20w-vpn Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.62% 0.45
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@zyxel.com.tw 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
Vendor Advisory