← Vulnerability feed

Vulnerability record · CVE-2021-35027 · published 29 September 2021

CVE-2021-35027: Zyxel zywall vpn2s firmware path traversal vulnerability

Zyxel · Zywall Vpn2s Firmware

A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.

7.5 CVSS 3.1 High EPSS 2.0% · top 19.3% CWE-27 · CWE-27CWE-22 · Path traversal
7.5CVSS 3.1 base score, v2 5.0
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_V PatchVendor Advisory
https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_V PatchVendor Advisory

Track CVE-2021-35027 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-33012Zyxel usg 20w-vpn firmware os command injection vulnerabilityA command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series fi…EPSS 9.9%8.8CVE-2023-33011Zyxel usg 2200-vpn firmware vulnerabilityA format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.3…EPSS 0.34%8.8CVE-2023-34139Zyxel usg 2200-vpn firmware os command injection vulnerabilityA command injection vulnerability in the Free Time WiFi hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.36 Patch 2 and …EPSS 0.76%8.8CVE-2023-28767Zyxel usg 2200-vpn firmware os command injection vulnerabilityThe configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmwar…EPSS 0.40%8.0CVE-2023-34138Zyxel usg 20w-vpn firmware os command injection vulnerabilityA command injection vulnerability in the hotspot management feature of the Zyxel ATP series firmware versions 4.60 through 5.36 Patch 2, USG FLEX ser…EPSS 0.68%8.0CVE-2023-34141Zyxel usg 20w-vpn firmware os command injection vulnerabilityA command injection vulnerability in the access point (AP) management feature of the Zyxel ATP series firmware versions 5.00 through 5.36 Patch 2, US…EPSS 0.68%7.8CVE-2021-35028Zyxel zywall vpn2s firmware os command injection vulnerabilityA command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arb…EPSS 0.31%6.5CVE-2023-34140Zyxel usg 20w-vpn firmware classic buffer overflow vulnerabilityA buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.36 Patch 2, USG FLEX series firmware versions 4.50 through 5…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2021-35027), CISA KEV, FIRST EPSS (scores of 2026-10-13). This page is refreshed as NVD updates the record.