rainpwn

/cve  Assigned identifiers

20 CVEs.

Every vulnerability assigned an identifier, from 2022 to 2026. All reported to the vendor and published after a fix shipped. 10 of them have a full writeup here.

Vendors
ZYXEL · UANIA
Status
All patched
Range
2022 → 2026
Highest
9.8 · CVE-2022-0342

By year

20222
20238
20243
20255
20262
Year
Severity
Class

20 of 20 shown

TBAUANIA OS - Authenticated Remote Code ExecutionUaniaOSRemote code execution2026-09-14
High8.8Read research
CVE-2025-8078USG/ZyWALL Series - Remote Code Execution via CLI Command InjectionFirewallCommand injection2025-10-21
High7.2Read research
CVE-2025-9133USG/ZyWALL Series - Authentication BypassFirewallAuthentication bypass2025-10-21
High8.2Read research
CVE-2025-1731Remote Code Execution on ZYXEL FLEX H SeriesFLEX H SeriesRemote code execution2025-04-22
High7.8Read research
CVE-2025-1732Local Privilege Escalation on ZYXEL FLEX H SeriesFLEX H SeriesPrivilege escalation2025-04-22
Medium6.7Read research
CVE-2024-12398Privilege Escalation on AP/Security RouterAP, Security RouterPrivilege escalation2025-01-14
High8.8Read research
CVE-2024-9677Privilege Escalation by stealing authentication tokenUSG FLEX HPrivilege escalation2024-10-22
High7.8
CVE-2024-7203Remote Command Execution via CLI Command InjectionFirewallCommand injection2024-09-03
High7.2Read research
CVE-2024-1575Privilege Escalation on AP Access PointPrivilege escalation2024-07-23
Medium6.5
CVE-2023-37925Authenticated Local Attackers Can Access System Files via Debug CLI CommandFirewall, Access PointInformation disclosure2023-11-28
Medium5.5Read research
CVE-2023-5960USG FLEX Series - View sensitive files as guest userFirewallInformation disclosure2023-11-28
Medium5.5
CVE-2023-5797USG/ZyWALL Series - View sensitive token/logs as limited userFirewallInformation disclosure2023-11-28
Medium5.5
CVE-2023-5650USG/ZyWALL Series - Open Redirect in Web GUIFirewallOpen redirect2023-11-28
Medium5.5
CVE-2023-4397Buffer Overflow via Command Line InterfaceFirewallBuffer overflow2023-11-28
Medium4.4
CVE-2023-37926Buffer Overflow in CLI Log Dump FunctionFirewallBuffer overflow2023-11-28
Medium5.5
CVE-2023-27991USG/ZyWALL Series - Remote Command Execution via CLI Command InjectionFirewallCommand injection2023-04-25
High8.8Read research
CVE-2023-27990USG/ZyWALL Series - Stored XSS via script upload FirewallCross-site scripting2023-04-25
Medium4.8
CVE-2022-40603USG/ZyWALL Series - Cross Site Scripting in CGI endpointFirewallCross-site scripting2022-12-06
Medium6.1
CVE-2022-0342USG/ZyWALL Series - Web Authentication BypassFirewallAuthentication bypass2022-03-29
Critical9.8

/advisories  Disclosed, CVE pending

2 advisories, no identifier yet.

Both vendors shipped a fix and published the advisory. Neither has a CVE yet. UANIA is in the table above as well, under TBA.

SA-2026-001UANIAAuthenticated remote code execution: a misconfigured UBUS ACL allows arbitrary file writes.UaniaOS 2.1 to 3.0.0Fixed in 3.0.12026-01-27High8.8AdvisoryGHUMI-2026-01Breldo ItaliaFour issues in one component: OS command injection, improper access control, SQL injection and cross-site scripting.Breldo O.S 6.0, UserPanelFixed in 6.12026-04-26Hackerhood, Red Hot CyberHigh8.8Advisory