Is USG50 vulnerable? CVE-2020-9054

abc

It isn't mentioned in the security advisory list of vulnerable firewalls; is that because it's not affected, or because the device is not supported anymore?

USG_User

Has anybody already installed the

https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml

CVE-2020-9054 patch on an USG device? Any problems to be expected?

USG_User

Just installed the patch on our USG110. But contrary to the name stated at the support website "V4.35(AAPH.3)C0", the installed patch reads: "V4.35(AAPH.2)ITS-WK08-r92067". Is it correct?

Zyxel_Jerry

Hi @abc

Welcome to Zyxel community

USG 50 is not mentioned in the security advisory list of vulnerable firewalls because it is not affected.

In the article : https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml has mentioned:

UTM, ATP, and VPN firewalls running firmware version ZLD V4.35 Patch 0 through ZLD V4.35 Patch 2. Those with firmware versions before ZLD V4.35 Patch 0 are NOT affected.

 

Hi @USG_User ,

Yes it’s the correct version. The version is a hotfix for this vulnerability. This fix will also be included into the upcoming formal release.