What is the CVSS score of CVE-2021-35029?

CVE-2021-35029 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.3%.

Usg50 Firmware CVE-2021-35029

CRITICAL

Improper Authentication (CWE-287)

2021-07-02 security@zyxel.com.tw

Authentication Bypass Zyxel Usg50 Firmware Zywall 110 Firmware Zywall 1100 Firmware Zywall 310 Firmware Usg20 Vpn Firmware Usg20W Vpn Firmware Usg40 Firmware Usg40W Firmware Usg60 Firmware Usg60W Firmware Usg110 Firmware Usg210 Firmware Usg310 Firmware Usg1100 Firmware Usg1900 Firmware Usg2200 Vpn Firmware Zywall Vpn100 Firmware Zywall Vpn300 Firmware Usg Flex 100 Firmware Usg Flex 100W Firmware Usg Flex 200 Firmware Usg Flex 500 Firmware Usg Flex 700 Firmware Usg300 Firmware Usg1000 Firmware Usg2000 Firmware Usg20 Firmware Usg20W Firmware Usg100 Firmware Usg200 Firmware Zywall Atp100 Firmware Zywall Atp100W Firmware Zywall Atp200 Firmware Zywall Atp500 Firmware Zywall Atp700 Firmware Zywall Atp800 Firmware Zywall Vpn50 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jul 02, 2021 - 11:15 nvd

CRITICAL 9.8

DescriptionNVD

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.

AnalysisAI

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device. Affected products include: Zyxel Usg1900 Firmware, Zyxel Usg1100 Firmware, Zyxel Usg310 Firmware, Zyxel Usg210 Firmware, Zyxel Usg110 Firmware. Version information: through 4.64.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.