Alessandro Sgreccia. I do vulnerability research on network security appliances: firewalls, access points and security routers. Twenty findings since March 2022, all patched. Nineteen carry a CVE on NVD, and the twentieth is waiting on MITRE. Mostly ZYXEL, plus UANIA and Breldo Italia.
Legend: 
| Year | Total | |
|---|---|---|
2022 |
|
2 |
2023 |
|
8 |
2024 |
|
3 |
2025 |
|
5 |
2026 |
|
2 |
Six of the 2023 findings went out on the same day, 28 November.
| Class | Total | |
|---|---|---|
| Command injection | |
4 |
| Privilege escalation | |
4 |
| Information disclosure | |
3 |
| Authentication bypass | |
2 |
| Buffer overflow | |
2 |
| Cross-site scripting | |
2 |
| Remote code execution | |
2 |
| Open redirect | |
1 |
One of the twenty is critical. A 2022 authentication bypass on the USG and ZyWALL series, CVSS 9.8, where the CGI program handed administrative access to a request that never logged in.
All twenty, newest first
| Identifier | CVSS | Product | Advisory | Writeup |
|---|---|---|---|---|
pending |
 |
UaniaOS | advisory | writeup |
| CVE-2025-11730 |  |
Firewall | advisory | writeup |
| CVE-2025-9133 |  |
Firewall | advisory | writeup |
| CVE-2025-8078 | |
Firewall | advisory | writeup |
| CVE-2025-1731 |  |
FLEX H Series | advisory | writeup |
| CVE-2025-1732 |  |
FLEX H Series | advisory | writeup |
| CVE-2024-12398 | |
AP, Security Router | advisory | writeup |
| CVE-2024-9677 | |
USG FLEX H | advisory | |
| CVE-2024-7203 | |
Firewall | advisory | writeup |
| CVE-2024-1575 |  |
Access Point | advisory | |
| CVE-2023-5797 |  |
Firewall | advisory | |
| CVE-2023-5960 | |
Firewall | advisory | |
| CVE-2023-37926 | |
Firewall | advisory | |
| CVE-2023-37925 | |
Firewall, Access Point | advisory | writeup |
| CVE-2023-4397 |  |
Firewall | advisory | |
| CVE-2023-5650 | |
Firewall | advisory | |
| CVE-2023-27990 |  |
Firewall | advisory | |
| CVE-2023-27991 | |
Firewall | advisory | writeup |
| CVE-2022-40603 |  |
Firewall | advisory | |
| CVE-2022-0342 |  |
Firewall | advisory |
- Writeups, thirteen of them, each with its disclosure timeline at the end.
- The CVE index puts every identifier next to its score and the vendor advisory.
- Seven proof of concept scripts are in rainpwn/exploits.
- /work is the page for a vendor: the ways of handing a device over, and what each one misses.
rainpwn@protonmail.com, and the PGP key if you would rather encrypt it.
If a writeup saved you an evening, you can buy me a coffee.
From the surface to root.