CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-35029
Critical (9.8) in zyxel. EPSS 2.3% chance of exploitation in the next 30 days.
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zyxel:usg1000_firmware
- zyxel:usg100_firmware
- zyxel:usg1100_firmware
- zyxel:usg110_firmware
- zyxel:usg1900_firmware
- zyxel:usg20-vpn_firmware
- zyxel:usg2000_firmware
- zyxel:usg200_firmware
- zyxel:usg20_firmware
- zyxel:usg20w-vpn_firmware
- zyxel:usg20w_firmware
- zyxel:usg210_firmware
- zyxel:usg2200-vpn_firmware
- zyxel:usg300_firmware
- zyxel:usg310_firmware
- zyxel:usg40_firmware
- zyxel:usg40w_firmware
- zyxel:usg50_firmware
- zyxel:usg60_firmware
- zyxel:usg60w_firmware
- zyxel:usg_flex_100_firmware
- zyxel:usg_flex_100w_firmware
- zyxel:usg_flex_200_firmware
- zyxel:usg_flex_500_firmware
- zyxel:usg_flex_700_firmware
- zyxel:zywall_1100_firmware
- zyxel:zywall_110_firmware
- zyxel:zywall_310_firmware
- zyxel:zywall_atp100_firmware
- zyxel:zywall_atp100w_firmware
- zyxel:zywall_atp200_firmware
- zyxel:zywall_atp500_firmware
- zyxel:zywall_atp700_firmware
- zyxel:zywall_atp800_firmware
- zyxel:zywall_vpn100_firmware
- zyxel:zywall_vpn300_firmware
- zyxel:zywall_vpn50_firmware