zyxel usg20w-vpn firmware

Name: zyxel usg20w-vpn firmware
Brand: zyxel

productUS

cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

4critical2high3medium0low

updated 2026-10-28

vulnerabilities (11)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-9054US	critical9.8OT critical	100.0% (100th)	KEV	4.35\(abar.3\)c0	2020-03-04	4.35 → 4.35\(abar.3\)c0
CVE-2022-30525US	critical9.8OT critical	99.9% (100th)	KEV	5.30	2022-05-12	5.10 → 5.30
CVE-2020-29583US	critical9.8OT critical	90.2% (100th)	KEV	no fix	2020-12-22	= 4.60
CVE-2019-9955US	medium6.1	21.2% (98th)	Exploit	no fix	2019-04-22	= 4.31
CVE-2022-30526US	high7.8	1.13% (66th)	Exploit	no fix	2022-07-19	4.16 → 5.30
CVE-2022-38547US	high7.2	2.83% (87th)	—	no fix	2023-02-07	4.30 → 5.32
CVE-2021-35029US	critical9.8	2.25% (83rd)	—	no fix	2021-07-02	4.35 → 5.01
CVE-2022-2030US	medium6.5	1.35% (71st)	—	no fix	2022-07-19	4.20 → 5.30
CVE-2023-6398US	—	1.33% (71st)	—	5.37	2024-02-20	2 versions
CVE-2023-6764US	—	0.89% (59th)	—	5.37	2024-02-20	2 versions
CVE-2023-6399US	medium6.5	0.65% (51st)	—	5.37	2024-02-20	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')4 CVEs
CWE-134Use of Externally-Controlled Format String2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-269Improper Privilege Management1 CVEs
CWE-287Improper Authentication1 CVEs
CWE-312Cleartext Storage of Sensitive Information1 CVEs
CWE-522Insufficiently Protected Credentials1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.