01 Alessandro Sgreccia / rainpwn
Most of it is reading. The findings are in what nobody documented.
- CVEs assigned
- 21
- highest CVSS
- 9.8
- Hall of Fame
- ZYXEL
02 How I work
Most findings are in what one layer assumes about another.
Scope
Almost entirely ZYXEL network appliances: USG/ZyWALL and ATP firewalls, USG FLEX and FLEX H, access points and security routers. Firmware from ZLD 5.35 to 5.41, and uOS 1.31.
Method
Reading the management interface against the CLI it drives, then against the services and binaries underneath. That means comparing what one layer claims to enforce with what the layer below actually checks.
Disclosure
Every issue is reported to the vendor and published after a fix ships. Every CVE here is on NVD with a matching vendor advisory.
03 Latest writeups
19 Oct 2026
What I built into my Zyxel USG FLEX 100H
—18 min16 Oct 2026A Cloudflare Tunnel inside my Zyxel firewall
—3 min11 Oct 2026Zyxel ZON and SecuExtender, now on Linux
—4 min14 Sept 2026UANIA OS: Authenticated Remote Code Execution
—14 min05 Feb 2026CVE-2025-11730: Remote Code Execution via DDNS configuration in ZYXEL ATP/USG Series (V5.41)
CVE-2025-117306 min04 About
Alessandro Sgreccia, online as rainpwn. Part of the Hackerhood team since July 2023.