Security readout for executives and security teams
Plain-English summary
CVE-2021-35028 is a command injection flaw in Zyxel VPN2S firmware. An authenticated local user could cause the device to run operating-system commands, risking full compromise of confidentiality, integrity, and availability on the appliance.
Executive priority
Treat as a high-priority appliance hygiene issue if VPN2S is present. It is not evidenced here as active internet-scale exploitation, but command execution on a firewall/VPN device can undermine network trust and incident containment.
Technical view
The issue is CWE-78 command injection in a CGI program in Zyxel ZyWALL VPN2S firmware 1.12(ABLN.0)C0. The CVSS 3.1 score is 7.3 with adjacent/local-style access constraints, high complexity, high privileges, user interaction, changed scope, and high CIA impact.
Likely exposure
Exposure is limited to environments running Zyxel ZyWALL VPN2S firmware version 1.12(ABLN.0)C0. The source bundle does not identify other Zyxel products or versions as affected.
Exploitation context
The bundle states authenticated local exploitation and does not cite public exploitation. It is not listed as CISA KEV in the provided data. The required privileges and interaction reduce mass-exploitation likelihood, but impact is serious on affected appliances.
Researcher notes
Evidence is narrow: affected product, version, weakness class, and CVSS are available, but the bundle does not include exploit details, proof of active exploitation, or explicit fix text. Avoid extrapolating to other Zyxel models without vendor confirmation.
Mitigation direction
- Inventory Zyxel VPN2S appliances and record exact firmware versions.
- Review Zyxel’s advisory for the vendor-supported fixed version or mitigation.
- Restrict administrative and local access to trusted users only.
- Monitor appliance logs for unusual CGI or administrative activity.
- Retire or isolate appliances that cannot be updated safely.
Validation and detection
- Confirm whether any ZyWALL VPN2S runs firmware 1.12(ABLN.0)C0.
- Check asset records for VPN2S devices in branch or edge networks.
- Verify vendor advisory status before applying remediation.
- Review authentication and local access paths to affected devices.
- Document whether the environment has affected firmware or no exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-35028 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H0.76Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.zyxel.com/support/Zyxel_security_advisory_for_directory_traversal_and_command_injection_vulnerabilities_of_VPN2S_Firewall.shtmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.