CVE-2024-42058

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Zyxel	ATP series firmware	versions V4.32 through V5.38
Zyxel	USG FLEX series firmware	versions V4.50 through V5.38
Zyxel	USG FLEX 50(W) series firmware	versions V5.20 through V5.38
Zyxel	USG20(W)-VPN series firmware	versions V5.20 through V5.38
zyxel	atp800_firmware	>= 4.32, <= 5.38
zyxel	usg_flex_700h_firmware	>= 4.5, <= 5.38
zyxel	usg_flex_50w_firmware	>= 5.20, <= 5.38

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024Vendor Advisory

Timeline

Published: Sep 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-420597.2A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmwa CVE-2024-420607.2A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmwa CVE-2024-420616.1A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.3 CVE-2024-420627.2CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and reg CVE-2024-420635.5In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode CVE-2024-420645.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip pipe if the pipe idx not set properly [why] Driv CVE-2024-420655.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init Add an explicit che CVE-2024-420665.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix potential integer overflow in page size calculation Explic CVE-2024-420675.5In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_rox() into account with bpf_jit_binary CVE-2024-420685.5In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_r CVE-2024-420695.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix possible double free in error handling path When auxili CVE-2024-42075.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior t