Vulnerabilites related to zyxel - usg40w_firmware
CVE-2020-29583 (GCVE-0-2020-29583)
Vulnerability from cvelistv5
Published
2020-12-22 00:00
Modified
2025-02-10 22:16
Severity ?
EPSS score ?
Summary
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T16:55:10.633Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.zyxel.com/support/security_advisories.shtml", }, { tags: [ "x_transferred", ], url: "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf", }, { tags: [ "x_transferred", ], url: "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15", }, { tags: [ "x_transferred", ], url: "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release", }, { tags: [ "x_transferred", ], url: "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html", }, { tags: [ "x_transferred", ], url: "https://www.zyxel.com/support/CVE-2020-29583.shtml", }, { tags: [ "x_transferred", ], url: "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2020-29583", options: [ { Exploitation: "active", }, { Automatable: "yes", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-02-10T22:11:59.767015Z", version: "2.0.3", }, type: "ssvc", }, }, { other: { content: { dateAdded: "2021-11-03", reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-29583", }, type: "kev", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-522", description: "CWE-522 Insufficiently Protected Credentials", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-10T22:16:05.647Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2023-10-28T00:43:07.540Z", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://www.zyxel.com/support/security_advisories.shtml", }, { url: "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf", }, { url: "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15", }, { url: "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release", }, { url: "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html", }, { url: "https://www.zyxel.com/support/CVE-2020-29583.shtml", }, { url: "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2020-29583", datePublished: "2020-12-22T00:00:00.000Z", dateReserved: "2020-12-06T00:00:00.000Z", dateUpdated: "2025-02-10T22:16:05.647Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2022-38547 (GCVE-0-2022-38547)
Vulnerability from cvelistv5
Published
2023-02-07 00:00
Modified
2025-03-25 15:39
Severity ?
EPSS score ?
Summary
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | ZyWALL/USG series firmware |
Version: 4.20 through 4.72 |
||||||||||||||||
|
|||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T10:54:04.001Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls", }, ], title: "CVE Program Container", }, { metrics: [ { other: { content: { id: "CVE-2022-38547", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-03-25T15:39:35.477790Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2025-03-25T15:39:42.181Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "ZyWALL/USG series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.20 through 4.72", }, ], }, { product: "VPN series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 5.32", }, ], }, { product: "USG FLEX series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.32", }, ], }, { product: "ATP series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.32 through 5.32", }, ], }, ], descriptions: [ { lang: "en", value: "A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-78", description: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2023-02-07T00:00:00.000Z", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls", }, ], }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2022-38547", datePublished: "2023-02-07T00:00:00.000Z", dateReserved: "2022-08-22T00:00:00.000Z", dateUpdated: "2025-03-25T15:39:42.181Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2019-9955 (GCVE-0-2019-9955)
Vulnerability from cvelistv5
Published
2019-04-22 19:38
Modified
2024-08-04 22:10
Severity ?
EPSS score ?
Summary
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2019/Apr/22 | mailing-list, x_refsource_FULLDISC | |
| https://www.exploit-db.com/exploits/46706/ | exploit, x_refsource_EXPLOIT-DB | |
| http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html | x_refsource_MISC | |
| https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml | x_refsource_CONFIRM |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T22:10:08.670Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", }, { name: "20190416 CVE-2019-9955 Refelected XSS on Zyxel Login page", tags: [ "mailing-list", "x_refsource_FULLDISC", "x_transferred", ], url: "http://seclists.org/fulldisclosure/2019/Apr/22", }, { name: "46706", tags: [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred", ], url: "https://www.exploit-db.com/exploits/46706/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2019-04-15T00:00:00", descriptions: [ { lang: "en", value: "On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2019-04-22T19:38:59", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", }, { name: "20190416 CVE-2019-9955 Refelected XSS on Zyxel Login page", tags: [ "mailing-list", "x_refsource_FULLDISC", ], url: "http://seclists.org/fulldisclosure/2019/Apr/22", }, { name: "46706", tags: [ "exploit", "x_refsource_EXPLOIT-DB", ], url: "https://www.exploit-db.com/exploits/46706/", }, { tags: [ "x_refsource_MISC", ], url: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2019-9955", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", refsource: "MISC", url: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", }, { name: "20190416 CVE-2019-9955 Refelected XSS on Zyxel Login page", refsource: "FULLDISC", url: "http://seclists.org/fulldisclosure/2019/Apr/22", }, { name: "46706", refsource: "EXPLOIT-DB", url: "https://www.exploit-db.com/exploits/46706/", }, { name: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", refsource: "MISC", url: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", }, { name: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", refsource: "CONFIRM", url: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2019-9955", datePublished: "2019-04-22T19:38:59", dateReserved: "2019-03-23T00:00:00", dateUpdated: "2024-08-04T22:10:08.670Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2022-0342 (GCVE-0-2022-0342)
Vulnerability from cvelistv5
Published
2022-03-28 12:05
Modified
2024-08-02 23:25
Severity ?
EPSS score ?
Summary
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | USG/ZyWALL series firmware |
Version: 4.20 through 4.70 |
|||||||||||||||||||||
|
||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T23:25:40.167Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "USG/ZyWALL series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.20 through 4.70", }, ], }, { product: "USG FLEX series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.20", }, ], }, { product: "ATP series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.32 through 5.20", }, ], }, { product: "VPN series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 5.20", }, ], }, { product: "NSG series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "1.20 through 1.33 Patch 4", }, ], }, ], descriptions: [ { lang: "en", value: "An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287: Improper Authentication", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-03-28T12:05:11", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@zyxel.com.tw", ID: "CVE-2022-0342", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "USG/ZyWALL series firmware", version: { version_data: [ { version_value: "4.20 through 4.70", }, ], }, }, { product_name: "USG FLEX series firmware", version: { version_data: [ { version_value: "4.50 through 5.20", }, ], }, }, { product_name: "ATP series firmware", version: { version_data: [ { version_value: "4.32 through 5.20", }, ], }, }, { product_name: "VPN series firmware", version: { version_data: [ { version_value: "4.30 through 5.20", }, ], }, }, { product_name: "NSG series firmware", version: { version_data: [ { version_value: "1.20 through 1.33 Patch 4", }, ], }, }, ], }, vendor_name: "Zyxel", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.", }, ], }, impact: { cvss: { baseScore: "9.8", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287: Improper Authentication", }, ], }, ], }, references: { reference_data: [ { name: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", refsource: "CONFIRM", url: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2022-0342", datePublished: "2022-03-28T12:05:11", dateReserved: "2022-01-24T00:00:00", dateUpdated: "2024-08-02T23:25:40.167Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2020-9054 (GCVE-0-2020-9054)
Vulnerability from cvelistv5
Published
2020-03-04 19:30
Modified
2025-02-07 13:09
Severity ?
EPSS score ?
Summary
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
References
| ▼ | URL | Tags |
|---|---|---|
| https://cwe.mitre.org/data/definitions/78.html | x_refsource_MISC | |
| https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml | x_refsource_CONFIRM | |
| https://kb.cert.org/vuls/id/498544/ | third-party-advisory, x_refsource_CERT-VN | |
| https://kb.cert.org/artifacts/cve-2020-9054.html | x_refsource_MISC | |
| https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/ | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | ZyXEL | NAS326 |
Version: V5.21(AAZF.7)C0 < |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T10:19:19.559Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://cwe.mitre.org/data/definitions/78.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", }, { name: "VU#498544", tags: [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred", ], url: "https://kb.cert.org/vuls/id/498544/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", }, ], title: "CVE Program Container", }, { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2020-9054", options: [ { Exploitation: "active", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2025-02-07T13:09:21.970154Z", version: "2.0.3", }, type: "ssvc", }, }, { other: { content: { dateAdded: "2022-03-25", reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-9054", }, type: "kev", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-78", description: "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-07T13:09:37.708Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "NAS326", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V5.21(AAZF.7)C0", status: "affected", version: "V5.21(AAZF.7)C0", versionType: "custom", }, ], }, { product: "NAS520", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V5.21(AASZ.3)C0", status: "affected", version: "V5.21(AASZ.3)C0", versionType: "custom", }, ], }, { product: "NAS540", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V5.21(AATB.4)C0", status: "affected", version: "V5.21(AATB.4)C0", versionType: "custom", }, ], }, { product: "NAS542", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V5.21(ABAG.4)C0", status: "affected", version: "V5.21(ABAG.4)C0", versionType: "custom", }, ], }, { product: "NSA210", vendor: "ZyXEL", versions: [ { status: "affected", version: "all", }, ], }, { product: "NSA220", vendor: "ZyXEL", versions: [ { status: "affected", version: "all", }, ], }, { product: "NSA220+", vendor: "ZyXEL", versions: [ { status: "affected", version: "all", }, ], }, { product: "NSA221", vendor: "ZyXEL", versions: [ { status: "affected", version: "all", }, ], }, { product: "NSA310", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V4.75(AALH.2)C0", status: "affected", version: "V4.75(AALH.2)C0", versionType: "custom", }, ], }, { product: "NSA320", vendor: "ZyXEL", versions: [ { status: "affected", version: "all", }, ], }, { product: "NSA320S", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V4.75(AANV.2)C0", status: "affected", version: "V4.75(AANV.2)C0", versionType: "custom", }, ], }, { product: "NSA325", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V4.81(AAAJ.1)C0", status: "affected", version: "V4.81(AAAJ.1)C0", versionType: "custom", }, ], }, { product: "NSA325v2", vendor: "ZyXEL", versions: [ { lessThanOrEqual: "V4.81(AALS.1)C0", status: "affected", version: "V4.81(AALS.1)C0", versionType: "custom", }, ], }, ], credits: [ { lang: "en", value: "Thanks to Alex Holden of Hold Security for finding and reporting this vulnerability.", }, ], datePublic: "2020-02-20T00:00:00.000Z", descriptions: [ { lang: "en", value: "Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2", }, ], exploits: [ { lang: "en", value: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-78", description: "CWE-78 OS Command Injection", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-03-04T19:30:18.000Z", orgId: "37e5125f-f79b-445b-8fad-9564f167944b", shortName: "certcc", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://cwe.mitre.org/data/definitions/78.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", }, { name: "VU#498544", tags: [ "third-party-advisory", "x_refsource_CERT-VN", ], url: "https://kb.cert.org/vuls/id/498544/", }, { tags: [ "x_refsource_MISC", ], url: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, { tags: [ "x_refsource_MISC", ], url: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", }, ], solutions: [ { lang: "en", value: "ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, NAS542, ATP100, ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200, VPN50, VPN100, VPN300, VPN1000, ZyWALL110, ZyWALL310, and ZyWALL1100 devices.", }, ], source: { discovery: "UNKNOWN", }, title: "ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi", workarounds: [ { lang: "en", value: "Block access to the ZyXEL device web interface:\n\nThis issue can be mitigated by blocking (for example with a firewall) access to the web interface (80/tcp and 443/tcp) of any vulnerable ZyXEL device. Any machine that can access the ZyXEL web interface should not also be able to access the internet.\n\nRestrict access to vulnerable ZyXEL devices:\n\nDirect exploitation of this vulnerability can be mitigated by restricting access to vulnerable devices. In particular, do not expose such devices directly to the internet. Note however, that it is still possible for attackers to exploit devices that are not directly connected to the internet. For example, by way of viewing a web page.", }, ], x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cert@cert.org", DATE_PUBLIC: "2020-02-20T00:00:00.000Z", ID: "CVE-2020-9054", STATE: "PUBLIC", TITLE: "ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "NAS326", version: { version_data: [ { version_affected: "<=", version_name: "V5.21(AAZF.7)C0", version_value: "V5.21(AAZF.7)C0", }, ], }, }, { product_name: "NAS520", version: { version_data: [ { version_affected: "<=", version_name: "V5.21(AASZ.3)C0", version_value: "V5.21(AASZ.3)C0", }, ], }, }, { product_name: "NAS540", version: { version_data: [ { version_affected: "<=", version_name: "V5.21(AATB.4)C0", version_value: "V5.21(AATB.4)C0", }, ], }, }, { product_name: "NAS542", version: { version_data: [ { version_affected: "<=", version_name: "V5.21(ABAG.4)C0", version_value: "V5.21(ABAG.4)C0", }, ], }, }, { product_name: "NSA210", version: { version_data: [ { version_affected: "=", version_value: "all", }, ], }, }, { product_name: "NSA220", version: { version_data: [ { version_affected: "=", version_value: "all", }, ], }, }, { product_name: "NSA220+", version: { version_data: [ { version_affected: "=", version_value: "all", }, ], }, }, { product_name: "NSA221", version: { version_data: [ { version_affected: "=", version_value: "all", }, ], }, }, { product_name: "NSA310", version: { version_data: [ { version_affected: "<=", version_name: "V4.75(AALH.2)C0", version_value: "V4.75(AALH.2)C0", }, ], }, }, { product_name: "NSA320", version: { version_data: [ { version_affected: "=", version_value: "all", }, ], }, }, { product_name: "NSA320S", version: { version_data: [ { version_affected: "<=", version_name: "V4.75(AANV.2)C0", version_value: "V4.75(AANV.2)C0", }, ], }, }, { product_name: "NSA325", version: { version_data: [ { version_affected: "<=", version_name: "V4.81(AAAJ.1)C0", version_value: "V4.81(AAAJ.1)C0", }, ], }, }, { product_name: "NSA325v2", version: { version_data: [ { version_affected: "<=", version_name: "V4.81(AALS.1)C0", version_value: "V4.81(AALS.1)C0", }, ], }, }, ], }, vendor_name: "ZyXEL", }, ], }, }, credit: [ { lang: "eng", value: "Thanks to Alex Holden of Hold Security for finding and reporting this vulnerability.", }, ], data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2", }, ], }, exploit: [ { lang: "en", value: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, ], generator: { engine: "Vulnogram 0.0.9", }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-78 OS Command Injection", }, ], }, ], }, references: { reference_data: [ { name: "https://cwe.mitre.org/data/definitions/78.html", refsource: "MISC", url: "https://cwe.mitre.org/data/definitions/78.html", }, { name: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", refsource: "CONFIRM", url: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", }, { name: "VU#498544", refsource: "CERT-VN", url: "https://kb.cert.org/vuls/id/498544/", }, { name: "https://kb.cert.org/artifacts/cve-2020-9054.html", refsource: "MISC", url: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, { name: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", refsource: "MISC", url: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", }, ], }, solution: [ { lang: "en", value: "ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, NAS542, ATP100, ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200, VPN50, VPN100, VPN300, VPN1000, ZyWALL110, ZyWALL310, and ZyWALL1100 devices.", }, ], source: { discovery: "UNKNOWN", }, work_around: [ { lang: "en", value: "Block access to the ZyXEL device web interface:\n\nThis issue can be mitigated by blocking (for example with a firewall) access to the web interface (80/tcp and 443/tcp) of any vulnerable ZyXEL device. Any machine that can access the ZyXEL web interface should not also be able to access the internet.\n\nRestrict access to vulnerable ZyXEL devices:\n\nDirect exploitation of this vulnerability can be mitigated by restricting access to vulnerable devices. In particular, do not expose such devices directly to the internet. Note however, that it is still possible for attackers to exploit devices that are not directly connected to the internet. For example, by way of viewing a web page.", }, ], }, }, }, cveMetadata: { assignerOrgId: "37e5125f-f79b-445b-8fad-9564f167944b", assignerShortName: "certcc", cveId: "CVE-2020-9054", datePublished: "2020-03-04T19:30:18.400Z", dateReserved: "2020-02-18T00:00:00.000Z", dateUpdated: "2025-02-07T13:09:37.708Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2021-35029 (GCVE-0-2021-35029)
Vulnerability from cvelistv5
Published
2021-07-02 10:29
Modified
2024-08-04 00:33
Severity ?
EPSS score ?
Summary
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | USG/Zywall series Firmware |
Version: 4.35 through 4.64 |
||||||||||||||||
|
|||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T00:33:49.831Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "USG/Zywall series Firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.35 through 4.64", }, ], }, { product: "USG FLEX series Firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.35 through 5.01", }, ], }, { product: "ATP series Firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.35 through 5.01", }, ], }, { product: "VPN series Firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.35 through 5.01", }, ], }, ], descriptions: [ { lang: "en", value: "An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-287", description: "CWE-287: Improper Authentication", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-07-02T10:29:07", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@zyxel.com.tw", ID: "CVE-2021-35029", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "USG/Zywall series Firmware", version: { version_data: [ { version_value: "4.35 through 4.64", }, ], }, }, { product_name: "USG FLEX series Firmware", version: { version_data: [ { version_value: "4.35 through 5.01", }, ], }, }, { product_name: "ATP series Firmware", version: { version_data: [ { version_value: "4.35 through 5.01", }, ], }, }, { product_name: "VPN series Firmware", version: { version_data: [ { version_value: "4.35 through 5.01", }, ], }, }, ], }, vendor_name: "Zyxel", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.", }, ], }, impact: { cvss: { baseScore: "9.8", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-287: Improper Authentication", }, ], }, ], }, references: { reference_data: [ { name: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", refsource: "MISC", url: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2021-35029", datePublished: "2021-07-02T10:29:07", dateReserved: "2021-06-17T00:00:00", dateUpdated: "2024-08-04T00:33:49.831Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2022-40603 (GCVE-0-2022-40603)
Vulnerability from cvelistv5
Published
2022-12-06 00:00
Modified
2024-08-03 12:21
Severity ?
EPSS score ?
Summary
A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | ZyWALL/USG series firmware |
Version: 4.30 through 4.72 |
||||||||||||||||
|
|||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T12:21:46.447Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "ZyWALL/USG series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 4.72", }, ], }, { product: "VPN series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 5.31", }, ], }, { product: "USG FLEX series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.31", }, ], }, { product: "ATP series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.32 through 5.31", }, ], }, ], descriptions: [ { lang: "en", value: "A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.7, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-12-06T00:00:00", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls", }, ], }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2022-40603", datePublished: "2022-12-06T00:00:00", dateReserved: "2022-09-12T00:00:00", dateUpdated: "2024-08-03T12:21:46.447Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2022-30526 (GCVE-0-2022-30526)
Vulnerability from cvelistv5
Published
2022-07-19 05:45
Modified
2024-08-03 06:48
Severity ?
EPSS score ?
Summary
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | USG FLEX 100(W) firmware |
Version: 4.50 through 5.30 |
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T06:48:36.418Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "USG FLEX 100(W) firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 200 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 500 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 700 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "ATP series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.32 through 5.30", }, ], }, { product: "VPN series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 5.30", }, ], }, { product: "USG FLEX 50(W) firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.16 through 5.30", }, ], }, { product: "USG 20(W)-VPN firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.16 through 5.30", }, ], }, { product: "USG/ZyWALL series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.09 through 4.72", }, ], }, ], descriptions: [ { lang: "en", value: "A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-269", description: "CWE-269: Improper Privilege Management", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-08-31T18:06:17", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, { tags: [ "x_refsource_MISC", ], url: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@zyxel.com.tw", ID: "CVE-2022-30526", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "USG FLEX 100(W) firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 200 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 500 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 700 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "ATP series firmware", version: { version_data: [ { version_value: "4.32 through 5.30", }, ], }, }, { product_name: "VPN series firmware", version: { version_data: [ { version_value: "4.30 through 5.30", }, ], }, }, { product_name: "USG FLEX 50(W) firmware", version: { version_data: [ { version_value: "4.16 through 5.30", }, ], }, }, { product_name: "USG 20(W)-VPN firmware", version: { version_data: [ { version_value: "4.16 through 5.30", }, ], }, }, { product_name: "USG/ZyWALL series firmware", version: { version_data: [ { version_value: "4.09 through 4.72", }, ], }, }, ], }, vendor_name: "Zyxel", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.", }, ], }, impact: { cvss: { baseScore: "7.8", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-269: Improper Privilege Management", }, ], }, ], }, references: { reference_data: [ { name: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", refsource: "CONFIRM", url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, { name: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", refsource: "MISC", url: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2022-30526", datePublished: "2022-07-19T05:45:14", dateReserved: "2022-05-10T00:00:00", dateUpdated: "2024-08-03T06:48:36.418Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
CVE-2022-2030 (GCVE-0-2022-2030)
Vulnerability from cvelistv5
Published
2022-07-19 05:55
Modified
2024-08-03 00:24
Severity ?
EPSS score ?
Summary
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Zyxel | USG FLEX 100(W) firmware |
Version: 4.50 through 5.30 |
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T00:24:44.144Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "USG FLEX 100(W) firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 200 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 500 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "USG FLEX 700 firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.50 through 5.30", }, ], }, { product: "ATP series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.32 through 5.30", }, ], }, { product: "VPN series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.30 through 5.30", }, ], }, { product: "USG FLEX 50(W) firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.16 through 5.30", }, ], }, { product: "USG 20(W)-VPN firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.16 through 5.30", }, ], }, { product: "USG/ZyWALL series firmware", vendor: "Zyxel", versions: [ { status: "affected", version: "4.11 through 4.72", }, ], }, ], descriptions: [ { lang: "en", value: "A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-22", description: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-07-19T05:55:11", orgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", shortName: "Zyxel", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@zyxel.com.tw", ID: "CVE-2022-2030", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "USG FLEX 100(W) firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 200 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 500 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "USG FLEX 700 firmware", version: { version_data: [ { version_value: "4.50 through 5.30", }, ], }, }, { product_name: "ATP series firmware", version: { version_data: [ { version_value: "4.32 through 5.30", }, ], }, }, { product_name: "VPN series firmware", version: { version_data: [ { version_value: "4.30 through 5.30", }, ], }, }, { product_name: "USG FLEX 50(W) firmware", version: { version_data: [ { version_value: "4.16 through 5.30", }, ], }, }, { product_name: "USG 20(W)-VPN firmware", version: { version_data: [ { version_value: "4.16 through 5.30", }, ], }, }, { product_name: "USG/ZyWALL series firmware", version: { version_data: [ { version_value: "4.11 through 4.72", }, ], }, }, ], }, vendor_name: "Zyxel", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.", }, ], }, impact: { cvss: { baseScore: "6.5", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", }, ], }, ], }, references: { reference_data: [ { name: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", refsource: "CONFIRM", url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "96e50032-ad0d-4058-a115-4d2c13821f9f", assignerShortName: "Zyxel", cveId: "CVE-2022-2030", datePublished: "2022-07-19T05:55:11", dateReserved: "2022-06-08T00:00:00", dateUpdated: "2024-08-03T00:24:44.144Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2021-07-02 11:15
Modified
2024-11-21 06:11
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0AB64698-F450-405C-9D27-EE5A34466835", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*", matchCriteriaId: "60F4E816-C4D3-451A-965C-45387D7DEB5B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "37AB8F08-EEEB-4318-8A5F-10211B61E852", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*", matchCriteriaId: "4B68C4BD-3279-47AB-AC2A-7555163B12E2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C3ED3A6D-68BC-48F6-AC34-99C5C012AF85", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*", matchCriteriaId: "F302801D-3720-4598-8458-A8938BD6CB46", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D5C0676F-CA90-4E29-8131-AD2026E8E79D", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*", matchCriteriaId: "EAFF1122-755A-4531-AA2E-FD6E8478F92F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4F17EF47-19AE-40BC-B547-B5900CC6D627", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*", matchCriteriaId: "4834AC5E-884D-4A1C-A39B-B3F4A281E3CB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9DED36D6-2286-4CDF-BACF-48403F3FCCE0", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1E355564-3F7A-4EE4-AD65-A84B78BB5395", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "23F9913B-2AE5-4B07-9EED-5A5F18B3F541", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2D485C08-FC2E-4569-BB49-249F7BDA149C", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "6AB1AAB7-AACC-4535-8C30-2D1FF7B2D647", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg300:-:*:*:*:*:*:*:*", matchCriteriaId: "CC3082ED-A564-494D-8427-B61F15F6DD88", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9755AA21-D626-453A-A7E1-0069832E861A", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1000:-:*:*:*:*:*:*:*", matchCriteriaId: "6626D8CA-2E58-46F7-9592-4922A3E6DF79", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg2000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C6EDA25D-48DE-4B4A-9792-D9587A6FB8FC", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg2000:-:*:*:*:*:*:*:*", matchCriteriaId: "748C9FE8-E66D-480F-9688-75E563332A23", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "8AC24EC0-FA7F-4500-A9CB-4854286DD67D", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20:-:*:*:*:*:*:*:*", matchCriteriaId: "3F5C3A2C-12EA-4FAE-B088-665A90494685", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "01B72080-1F0E-484D-8929-67BC2585E62B", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w:-:*:*:*:*:*:*:*", matchCriteriaId: "B44BD562-5D3A-4E4F-B648-6E2D1F0B02C7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "ABDA4AA0-FE83-400C-A7AE-001611225552", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg50:-:*:*:*:*:*:*:*", matchCriteriaId: "FE138A97-1AB8-493D-92AA-276DFA40E14F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "6EAAF268-7195-4884-B90E-93054A8CAC95", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg100:-:*:*:*:*:*:*:*", matchCriteriaId: "656D8467-02C4-43F6-A64B-998300D71814", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "CF8B5062-6330-4369-9D7F-EA54E6A990E9", versionEndIncluding: "4.64", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg200:-:*:*:*:*:*:*:*", matchCriteriaId: "3F7F15F3-9A55-462F-8AE3-EE71B759DE68", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "6718F421-40F9-4599-9720-9F3461AD0693", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*", matchCriteriaId: "2B30A4C0-9928-46AD-9210-C25656FB43FB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "AE8626E7-8B32-4F54-9078-2C7E182783F7", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0D39FB8E-FF0D-40D2-A92D-FB1B2C89D29D", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "686F56DF-BE47-4A17-A275-F7F0F38A16CF", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "789C6F4B-1592-40C2-9DE1-1C436F6F2A2B", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "5B332B58-AF42-45E3-B224-9AD745485A14", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "A899D2DE-8C74-4EA1-BD87-B8BF37CBFB6D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A33C164A-F565-47AB-8F8C-3D418F36638B", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "F7F65954-FF1A-46A4-A003-FF8B9666880A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "817D54B2-A13E-4105-B63D-A0474BC63CD7", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "A4F6D0AA-CDD4-4F1C-98F1-1B381023B3F4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "EF1F9383-C537-4B57-B3B1-61F5E7165642", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "AA85BCA2-CEF5-44EF-BEFB-5DA2638F5F37", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B9AF0390-357C-4249-A7CF-EE902836A2FE", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "D50CC94B-4EAA-44A7-AEF1-415491572FB1", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FECB2D46-3776-4059-8F01-164641965C84", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "3EC7EB91-65C4-45EA-9CB4-3B3961724DCB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7EA23975-C587-4BC1-986A-55DA451A05CB", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "D902D9D2-5215-4A70-9D16-F1C3BA10EE18", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "24FD0B6C-EA3E-4AAC-BCFD-A58F0996988E", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "6762B13C-6FD5-49D7-B2D6-4986BAC3D425", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FC931102-95D8-4BF4-AA6B-F8F6CC4024C7", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "E7C35A94-304B-46FB-BAA0-4E0C4F34BEDD", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "05F5F64E-3020-4453-A183-454EF80025A7", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4ECA11E7-4DCE-4030-9602-F7336A434817", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg2200-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F0ED8D58-62BA-4225-8C68-0E8D75FB936C", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "68CB2401-479A-4124-B03F-589D7C1061FF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2E4763C9-EC74-4CAE-8A72-162E51ABBA9E", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "3D54C6A9-B282-4B5C-BAB0-24FB03415FA4", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B8A67D33-EF8E-4B70-891A-51DD5B4680D8", versionEndIncluding: "5.01", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device.", }, { lang: "es", value: "Una vulnerabilidad de omisión de la autenticación en la interfaz de administración basada en web de Zyxel USG/Zywall series versiones de firmware 4.35 hasta 4.64 y USG Flex, ATP, y VPN versiones de firmware 4.35 hasta 5.01, que podría permitir a un atacante remoto ejecutar comandos arbitrarios en un dispositivo afectado", }, ], id: "CVE-2021-35029", lastModified: "2024-11-21T06:11:42.280", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-07-02T11:15:08.930", references: [ { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel_security_advisory_for_attacks_against_security_appliances.shtml", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-287", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2023-02-07 02:15
Modified
2024-11-21 07:16
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C4EE6E9E-25BA-4F9A-B13A-9A4A405E24DC", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "35945749-7707-4057-A23C-F69615D78C9D", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FA692134-7730-4518-9CB1-BDAE32578EA7", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9A202967-379D-41C2-AF18-C287CD075677", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "467CC4CE-B69F-4341-B35B-293C36BEC8F1", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "84116343-9050-47AD-8C5D-6C69247BAE98", versionEndIncluding: "5.32", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A27B3207-D9E6-418D-AD64-A578E4DE77E6", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_50:-:*:*:*:*:*:*:*", matchCriteriaId: "646C1F07-B553-47B0-953B-DC7DE7FD0F8B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7108742C-1064-4657-9932-87BDBE1E2AC5", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FDA8914D-F868-4ECC-B110-FCA5C3C9EBA5", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "55177D6F-BD50-49EE-B8F8-2AFB3D2B0FFC", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7E3ACF88-2143-4D19-8C64-64170DC1771B", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C26CCE16-5719-4B2D-AC1D-AD2354A61046", versionEndIncluding: "5.32", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*", matchCriteriaId: "2B30A4C0-9928-46AD-9210-C25656FB43FB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "879037A2-5CCF-44C5-9B70-DA8E79AD3343", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DD415B02-D7C2-4C23-B0EF-2E13DFF5CFD1", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F9026D87-7D08-46D7-A9A6-6758FA7A5D0D", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1071A736-AE03-4C49-9F19-4E7B77E31C3E", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A625626B-2E60-4D54-A4FC-80B7C59EAC7A", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "509B75A6-B827-4328-B9F8-C0828279A29E", versionEndIncluding: "5.32", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "3F486DCF-02EB-49DC-862A-3CE9B55D8210", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "94A7F2DF-F22C-49DA-9563-BAFD59011B70", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "36CDEEE3-8284-4759-9B23-72989BBABBDD", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "149EABE0-AAB1-41C2-9A34-2C25650B83BF", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1DFEBB3B-F29D-4EE7-9ECE-F7711783A0EF", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A8BE4050-32D8-4306-A668-14F3CC8169EC", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FBCCCD01-5009-48B3-9484-925D5436C6D9", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.", }, { lang: "es", value: "Una vulnerabilidad de inyección de comando posterior a la autenticación en el comando CLI de las versiones de firmware de la serie Zyxel ZyWALL/USG 4.20 a 4.72, las versiones de firmware de la serie VPN 4.30 a 5.32, las versiones de firmware de la serie USG FLEX 4.50 a 5.32 y las versiones de firmware de la serie ATP 4.32 a 5.32, que podría permitir que un atacante autenticado con privilegios de administrador ejecute comandos del sistema operativo.", }, ], id: "CVE-2022-38547", lastModified: "2024-11-21T07:16:39.203", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.2, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2023-02-07T02:15:07.883", references: [ { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-78", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-78", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-12-06 02:15
Modified
2024-11-21 07:21
Severity ?
4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zyxel | atp800_firmware | * | |
| zyxel | atp800 | - | |
| zyxel | atp700_firmware | * | |
| zyxel | atp700 | - | |
| zyxel | atp500_firmware | * | |
| zyxel | atp500 | - | |
| zyxel | atp200_firmware | * | |
| zyxel | atp200 | - | |
| zyxel | atp100_firmware | * | |
| zyxel | atp100 | - | |
| zyxel | atp100w_firmware | * | |
| zyxel | atp100w | - | |
| zyxel | usg_flex_100w_firmware | * | |
| zyxel | usg_flex_100w | - | |
| zyxel | usg_flex_200_firmware | * | |
| zyxel | usg_flex_200 | - | |
| zyxel | usg_flex_500_firmware | * | |
| zyxel | usg_flex_500 | - | |
| zyxel | usg_flex_700_firmware | * | |
| zyxel | usg_flex_700 | - | |
| zyxel | usg_flex_50w_firmware | * | |
| zyxel | usg_flex_50w | - | |
| zyxel | vpn1000_firmware | * | |
| zyxel | vpn1000 | - | |
| zyxel | vpn300_firmware | * | |
| zyxel | vpn300 | - | |
| zyxel | vpn100_firmware | * | |
| zyxel | vpn100 | - | |
| zyxel | vpn50_firmware | * | |
| zyxel | vpn50 | - | |
| zyxel | usg40_firmware | * | |
| zyxel | usg40 | - | |
| zyxel | usg40w_firmware | * | |
| zyxel | usg40w | - | |
| zyxel | usg60_firmware | * | |
| zyxel | usg60 | - | |
| zyxel | usg60w_firmware | * | |
| zyxel | usg60w | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2198362A-9AED-4264-B7B2-0893B7E373D8", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2BB5BC64-7842-48F3-A4CE-14C01C8B20E1", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0026B391-B6C1-44EA-8199-A64915A9DB2B", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "26D9FD76-F27D-47F2-8037-E6640436DE16", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "316FF7FF-C4EC-4689-8A7A-F8E0AACE90C0", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "310253F5-731A-480E-858E-4971A50FD30F", versionEndIncluding: "5.31", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "E3C10EB0-D5E7-49C6-AB34-0F06ACE6A6D9", versionEndIncluding: "5.31", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "05A89511-5802-4C64-B198-5004C9167D12", versionEndIncluding: "5.31", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "909D4080-2BB9-4B53-B8B4-1CDBBF168BDE", versionEndIncluding: "5.31", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C8BE4D6D-178F-41D1-A502-18CF46DD9F3C", versionEndIncluding: "5.31", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "09CE942E-29AB-4CE7-8A88-1E68EAA40DA5", versionEndIncluding: "5.31", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*", matchCriteriaId: "110A1CA4-0170-4834-8281-0A3E14FC5584", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C0D78DFF-8DB8-4B05-B1B3-1D17C4424C04", versionEndIncluding: "5.31", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "476C3FC7-631B-4F02-851F-85E984A34590", versionEndIncluding: "5.31", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D5AB0BB4-35C0-41DA-90B3-07AE3E42FB38", versionEndIncluding: "5.31", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "8A256426-E5C9-45B6-993B-835D36138790", versionEndIncluding: "5.31", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "3AF32D67-EAFA-415E-AC6D-6E8E840D700D", versionEndIncluding: "4.72", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9427EA8C-A1AD-45CA-B601-A592A6A25F0B", versionEndIncluding: "4.72", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "C9526A60-BE21-40D1-BA36-3A146568CE54", versionEndIncluding: "4.72", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "6CA8E734-4071-41D0-9543-A440A2C3DBA6", versionEndIncluding: "4.72", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.", }, { lang: "es", value: "Una vulnerabilidad de Cross-Site Scripting (XSS) en el programa CGI de las versiones de firmware de la serie Zyxel ZyWALL/USG 4.30 a 4.72, versiones de firmware de la serie VPN 4.30 a 5.31, versiones de firmware de la serie USG FLEX 4.50 a 5.31 y versiones de firmware de la serie ATP 4.32 a 5.31. , lo que podría permitir a un atacante engañar a un usuario para que visite una URL manipulada con el payload XSS. Luego, el atacante podría obtener acceso a cierta información basada en el navegador si el script malicioso se ejecuta en el navegador de la víctima.", }, ], id: "CVE-2022-40603", lastModified: "2024-11-21T07:21:42.180", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.7, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 1.4, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-12-06T02:15:09.730", references: [ { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-12-22 22:15
Modified
2025-04-03 19:46
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
References
Impacted products
{ cisaActionDue: "2022-05-03", cisaExploitAdd: "2021-11-03", cisaRequiredAction: "Apply updates per vendor instructions.", cisaVulnerabilityName: "Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability", configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "660A9038-66FB-4F71-BA50-8ED69C2E2274", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "E892C61D-80DE-4FA4-9224-1B3C72A31F57", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "29398F33-D8B4-432D-A075-4454DA1B23F0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "BA146A61-7B27-4E48-87C1-A82F45FB692A", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "14F685CA-FBD9-4A00-BB23-BF914DFE41D9", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "022CF987-20A8-4450-A8B8-94AF2F2D453E", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg110_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "7540894B-A1EF-40C3-ABD3-D58CDB45622F", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*", matchCriteriaId: "4834AC5E-884D-4A1C-A39B-B3F4A281E3CB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg210_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "6556E988-676D-4E7A-BDC2-A53256548FEA", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*", matchCriteriaId: "EAFF1122-755A-4531-AA2E-FD6E8478F92F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg310_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "56EF63D0-63DD-4EFD-AE7A-5680710AE573", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*", matchCriteriaId: "F302801D-3720-4598-8458-A8938BD6CB46", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1100_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "8451A4C8-2023-41A4-81A9-91565CEC6918", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*", matchCriteriaId: "4B68C4BD-3279-47AB-AC2A-7555163B12E2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1900_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "7391C72E-CAB3-4FAD-9FB6-789F48516C26", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*", matchCriteriaId: "60F4E816-C4D3-451A-965C-45387D7DEB5B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg2200_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "B3B7B49D-7DB2-4D44-AC55-6B1F828B512D", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*", matchCriteriaId: "231547C3-33B8-42B7-983E-AA3C6CA5D107", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall110_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "52922CA2-1C1E-4972-A52E-D9FA84BCC4C1", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall110:-:*:*:*:*:*:*:*", matchCriteriaId: "2347F91E-8AA3-4EB5-AD7F-7602A46C20BD", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall310_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "C9336382-E759-4869-9B59-57366E176CA2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall310:-:*:*:*:*:*:*:*", matchCriteriaId: "3A97613C-26EF-481E-9215-197FE7A9D1C6", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall1100_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "271DE232-FAED-48A1-891C-33A6FDBA9EAA", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall1100:-:*:*:*:*:*:*:*", matchCriteriaId: "53A5732E-193B-4017-A434-A76BE80E20D9", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "7DC9FE97-6B7D-41E8-879C-572B23CB1105", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "61489A79-AAF5-4347-9E10-73F139D30EE2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "BB876002-669D-4052-B1B0-DA8F0B4EC500", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "3E6231DF-ADB3-43A9-AC3B-C72905584B05", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "DEDC5E3D-2103-4545-8611-B1C49B4B5BAB", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "246B2EF8-6412-4E69-91A5-B394BF4D299F", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "F6A568BA-58D3-400C-9742-8E966C90D83E", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "65E48F65-A408-4A93-BBBC-44D5054D9841", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "1B2E5F78-7F7B-46BA-A7B1-0A49F4A6509D", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "E39AE158-E577-403B-867E-CCD5F8EE5FC5", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "14484416-6575-4E23-96A7-F37936F75BAB", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*", matchCriteriaId: "2B30A4C0-9928-46AD-9210-C25656FB43FB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "A0597006-8FA7-4622-9C13-AFE9767CADE5", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "28D39C78-DD5A-47FB-9590-B79AABA1038B", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "438B93F0-7CBF-49E9-B556-CFEFE2E6EED0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:4.60:*:*:*:*:*:*:*", matchCriteriaId: "414BCC73-277B-48FD-8273-B33A780806D0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.", }, { lang: "es", value: "La versión de firmware 4.60 de los dispositivos Zyxel USG contiene una cuenta no documentada (zyfwp) con una contraseña que no puede ser cambiada. La contraseña para esta cuenta se puede encontrar en texto sin cifrar en el firmware. Esta cuenta puede ser usada por alguien para iniciar sesión en el servidor ssh o en la interfaz web con privilegios de administrador", }, ], id: "CVE-2020-29583", lastModified: "2025-04-03T19:46:18.343", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 10, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 10, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2020-12-22T22:15:14.443", references: [ { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf", }, { source: "cve@mitre.org", tags: [ "Release Notes", ], url: "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release", }, { source: "cve@mitre.org", tags: [ "Release Notes", ], url: "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Third Party Advisory", ], url: "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/CVE-2020-29583.shtml", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/security_advisories.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://ftp.zyxel.com/USG40/firmware/USG40_4.60%28AALA.1%29C0_2.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", ], url: "https://businessforum.zyxel.com/discussion/5252/zld-v4-60-revoke-and-wk48-firmware-release", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", ], url: "https://businessforum.zyxel.com/discussion/5254/whats-new-for-zld4-60-patch-1-available-on-dec-15", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Third Party Advisory", ], url: "https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://www.secpod.com/blog/a-secret-zyxel-firewall-and-ap-controllers-could-allow-for-administrative-access-cve-2020-29583/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/CVE-2020-29583.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/security_advisories.shtml", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Analyzed", weaknesses: [ { description: [ { lang: "en", value: "CWE-522", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-522", }, ], source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }
Vulnerability from fkie_nvd
Published
2019-04-22 20:29
Modified
2024-11-21 04:52
Severity ?
Summary
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zyxel | atp200_firmware | 4.31 | |
| zyxel | atp200 | - | |
| zyxel | atp500_firmware | 4.31 | |
| zyxel | atp500 | - | |
| zyxel | atp800_firmware | 4.31 | |
| zyxel | atp800 | - | |
| zyxel | usg20-vpn_firmware | 4.31 | |
| zyxel | usg20-vpn | - | |
| zyxel | usg20w-vpn_firmware | 4.31 | |
| zyxel | usg20w-vpn | - | |
| zyxel | usg40_firmware | 4.31 | |
| zyxel | usg40 | - | |
| zyxel | usg40w_firmware | 4.31 | |
| zyxel | usg40w | - | |
| zyxel | usg60_firmware | 4.31 | |
| zyxel | usg60 | - | |
| zyxel | usg60w_firmware | 4.31 | |
| zyxel | usg60w | - | |
| zyxel | usg110_firmware | 4.31 | |
| zyxel | usg110 | - | |
| zyxel | usg210_firmware | 4.31 | |
| zyxel | usg210 | - | |
| zyxel | usg310_firmware | 4.31 | |
| zyxel | usg310 | - | |
| zyxel | usg1100_firmware | 4.31 | |
| zyxel | usg1100 | - | |
| zyxel | usg1900_firmware | 4.31 | |
| zyxel | usg1900 | - | |
| zyxel | usg2200-vpn_firmware | 4.31 | |
| zyxel | usg2200-vpn | - | |
| zyxel | zywall_110_firmware | 4.31 | |
| zyxel | zywall_110 | - | |
| zyxel | zywall_310_firmware | 4.31 | |
| zyxel | zywall_310 | - | |
| zyxel | zywall_1100_firmware | 4.31 | |
| zyxel | zywall_1100 | - | |
| zyxel | vpn50_firmware | - | |
| zyxel | vpn50 | - | |
| zyxel | vpn100_firmware | - | |
| zyxel | vpn100 | - | |
| zyxel | vpn300_firmware | - | |
| zyxel | vpn300 | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "A0490C84-596F-48E7-A9EC-F22AC71C645A", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "205C9D58-FB8B-486A-81AF-D55D0B6550CE", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "9EB5D8BA-658C-409B-8D75-DA9C33DCB91B", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "C73CD6FB-DDC7-4C71-932F-1B945F8BF5DE", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "0C1BD569-475E-47AC-B0FA-0E2E7A78D0E4", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "FD0266E1-34D4-4875-960E-4549E062BD64", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "C81C76F5-C81A-4AF3-8CC3-7BB560D07500", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "D709F4D3-B94D-40A7-AFDF-235DCBBF34BA", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "A8B031CA-1C69-4E04-846F-9D6BBA2F40F1", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg110_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "D8018BB3-EF08-4FB7-A8FD-DF69F203D6E8", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*", matchCriteriaId: "4834AC5E-884D-4A1C-A39B-B3F4A281E3CB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg210_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "28A4D6DA-18D4-4214-9305-C15AA69581E8", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*", matchCriteriaId: "EAFF1122-755A-4531-AA2E-FD6E8478F92F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg310_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "737B376F-7CFF-4863-9C3B-43B033F17732", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*", matchCriteriaId: "F302801D-3720-4598-8458-A8938BD6CB46", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1100_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "441D2612-E0E3-4123-94FC-6A1B7AD74203", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*", matchCriteriaId: "4B68C4BD-3279-47AB-AC2A-7555163B12E2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1900_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "828A57FD-E3EB-4E42-ACEB-A660B13AF5FB", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*", matchCriteriaId: "60F4E816-C4D3-451A-965C-45387D7DEB5B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg2200-vpn_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "ED4E83E1-B78F-40FF-8EEC-0AB4A1E484E2", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg2200-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "68CB2401-479A-4124-B03F-589D7C1061FF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "5BF4C9AA-CCF9-4457-9BAD-056686ECC7B3", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "22D33EC8-AA9B-4BE9-9BE0-239CAD587E1E", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:4.31:*:*:*:*:*:*:*", matchCriteriaId: "886C5968-ACD9-411F-B6D2-00DB0A18BAE1", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:-:*:*:*:*:*:*:*", matchCriteriaId: "2834B453-1A34-47D2-8E65-030219AFED6D", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:-:*:*:*:*:*:*:*", matchCriteriaId: "4182F61A-D7FE-43EF-A884-9B2640EB78E0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:-:*:*:*:*:*:*:*", matchCriteriaId: "B30794EC-E419-448E-8C9F-E8BB583E1AE7", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.", }, { lang: "es", value: "En dispositivos Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100. La página de inicio de sesión del servidor de seguridad es vulnerable a Reflected XSS por medio del parámetro 'mp_idx' no saneado.", }, ], id: "CVE-2019-9955", lastModified: "2024-11-21T04:52:39.943", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-04-22T20:29:00.447", references: [ { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://seclists.org/fulldisclosure/2019/Apr/22", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://www.exploit-db.com/exploits/46706/", }, { source: "cve@mitre.org", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mailing List", "Third Party Advisory", ], url: "http://seclists.org/fulldisclosure/2019/Apr/22", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "https://www.exploit-db.com/exploits/46706/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2020-03-04 20:15
Modified
2025-03-21 19:50
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2
References
Impacted products
{ cisaActionDue: "2022-04-15", cisaExploitAdd: "2022-03-25", cisaRequiredAction: "Apply updates per vendor instructions.", cisaVulnerabilityName: "Zyxel Multiple NAS Devices OS Command Injection Vulnerability", configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "3FEC76CA-9F2C-4A44-93C5-C131E68B9A5E", versionEndExcluding: "5.21\\(aazf.7\\)c0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*", matchCriteriaId: "E0A01B19-4A91-4FBC-8447-2E854346DAC5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:nas520_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "09DE98E7-CE8E-4F45-9F1E-4A4345FBD443", versionEndExcluding: "5.21\\(aasz.3\\)c0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:nas520:-:*:*:*:*:*:*:*", matchCriteriaId: "07B2BA3D-40F0-4D59-8838-B226FAABF27E", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:nas540_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "511D5E0C-9110-4505-8DC6-5C06A10CBC20", versionEndExcluding: "5.21\\(aatb.4\\)c0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:nas540:-:*:*:*:*:*:*:*", matchCriteriaId: "B2F7264C-D32A-4EE9-BADC-78518D762BCA", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "608792D0-44B3-4A07-A48C-D3D71F26056D", versionEndExcluding: "5.21\\(abag.4\\)c0", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*", matchCriteriaId: "31C4DD0F-28D0-4BF7-897B-5EEC32AA7277", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1B482F4E-6E1B-45BD-A114-C389E2CD7542", versionEndExcluding: "4.35\\(abps.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0DE3AD47-1C82-4B8B-87F4-E545A7DAFE5C", versionEndExcluding: "4.35\\(abfw.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "352E7F31-76DB-4786-BCC0-E11F43550EB1", versionEndExcluding: "4.35\\(abfu.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "92E70F0C-D446-47B2-809B-D4680DAF13FC", versionEndExcluding: "4.35\\(abiq.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "CB019CF4-75AA-4CB0-BA44-42BE620C03B3", versionEndExcluding: "4.35\\(abaq.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D2C621E3-DD7D-4FD0-AD1F-6D7BFDCA38F7", versionEndExcluding: "4.35\\(abar.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "9E638CFB-A13D-429D-A8E7-275959673ED6", versionEndExcluding: "4.35\\(aala.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DB73D7EE-6A50-4DA5-B9A3-36E39244FF23", versionEndExcluding: "4.35\\(aalb.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1183A743-F349-4D93-8943-C80F8976A2BE", versionEndExcluding: "4.35\\(aaky.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4F0D184B-31BB-4808-AF97-03599283F181", versionEndExcluding: "4.35\\(aakz.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "8598C1A4-10CE-4092-9339-217AA27FF14D", versionEndExcluding: "4.35\\(aaph.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg110:-:*:*:*:*:*:*:*", matchCriteriaId: "4834AC5E-884D-4A1C-A39B-B3F4A281E3CB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg210_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B42E5510-F6BB-40DA-8115-4D324DDCF5B2", versionEndExcluding: "4.35\\(aapi.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg210:-:*:*:*:*:*:*:*", matchCriteriaId: "EAFF1122-755A-4531-AA2E-FD6E8478F92F", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4DE7E2A7-3083-4AB7-ABA8-9EE8585DA1C1", versionEndExcluding: "4.35\\(aapj.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg310:-:*:*:*:*:*:*:*", matchCriteriaId: "F302801D-3720-4598-8458-A8938BD6CB46", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DCDB08DB-DFBD-4A3C-86FD-5383D4B60248", versionEndExcluding: "4.35\\(aapk.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1100:-:*:*:*:*:*:*:*", matchCriteriaId: "4B68C4BD-3279-47AB-AC2A-7555163B12E2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg1900_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "FAED492E-9FDD-4F6F-91E0-6EDA3036C725", versionEndExcluding: "4.35\\(aapl.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg1900:-:*:*:*:*:*:*:*", matchCriteriaId: "60F4E816-C4D3-451A-965C-45387D7DEB5B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg2200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A54DCF88-38E3-4660-ABC2-829B2DA5C445", versionEndExcluding: "4.35\\(abae.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg2200:-:*:*:*:*:*:*:*", matchCriteriaId: "231547C3-33B8-42B7-983E-AA3C6CA5D107", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4FFB5E9D-75AD-4696-8EDF-A7726B5F2809", versionEndExcluding: "4.35\\(abhl.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2E5C5E12-CDDB-4DDF-AAA8-4AB499F5925F", versionEndExcluding: "4.35\\(abfv.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0120A42B-EA67-44DC-BE04-FECF0279187C", versionEndExcluding: "4.35\\(abfc.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A71B4358-0E6F-496E-BFCF-0B368CBD1D09", versionEndExcluding: "4.35\\(abip.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "025A43D2-42C3-4AEC-9C2E-61BAEB428545", versionEndExcluding: "4.35\\(aaaa.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall110:-:*:*:*:*:*:*:*", matchCriteriaId: "2347F91E-8AA3-4EB5-AD7F-7602A46C20BD", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7FB2E4BB-5684-4081-B9BA-80808E8ADD6F", versionEndExcluding: "4.35\\(aaab.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall310:-:*:*:*:*:*:*:*", matchCriteriaId: "3A97613C-26EF-481E-9215-197FE7A9D1C6", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "536BDA9F-4A29-4C59-8C39-F54794BE3026", versionEndExcluding: "4.35\\(aaac.3\\)c0", versionStartIncluding: "4.35", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall1100:-:*:*:*:*:*:*:*", matchCriteriaId: "53A5732E-193B-4017-A434-A76BE80E20D9", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2", }, { lang: "es", value: "Múltiples dispositivos network-attached storage (NAS) de ZyXEL cuando ejecutan la versión de firmware 5.21 contienen una vulnerabilidad de inyección de comando previa a la autenticación, que puede permitir a un atacante remoto no autenticado ejecutar código arbitrario sobre un dispositivo vulnerable. Los dispositivos NAS de ZyXEL alcanzan la autenticación utilizando el archivo ejecutable CGI weblogin.cgi. Este programa no puede sanear apropiadamente el parámetro username que se le pasó. Si el parámetro de username contiene determinados caracteres, puede permitir una inyección de comandos con los privilegios del servidor web que se ejecuta en el dispositivo ZyXEL. Aunque el servidor web no es ejecutado como el usuario root, los dispositivos ZyXEL incluyen una utilidad setuid que puede ser aprovechada para ejecutar cualquier comando con privilegios root. Como tal, se debe suponer que la explotación de esta vulnerabilidad puede conducir a la ejecución remota de código con privilegios root. Mediante el envío de una petición HTTP POST o GET especialmente diseñada hacia un dispositivo ZyXEL vulnerable, un atacante remoto no autenticado puede ejecutar código arbitrario en el dispositivo. Esto puede presentarse al conectar directamente a un dispositivo si es expuesto directamente a un atacante. Sin embargo, existen maneras de activar tales peticiones diseñadas inclusive si un atacante no posee conectividad directa con dispositivos vulnerables. Por ejemplo, simplemente visitando un sitio web puede comprometer cualquier dispositivo ZyXEL al que se pueda acceder desde el sistema cliente. Los productos afectados incluyen: NAS326 antes de la versión de firmware V5.21(AAZF.7)C0, NAS520 antes de la versión de firmware V5.21(AASZ.3)C0, NAS540 antes de la versión de firmware V5.21(AATB.4)C0 NAS542 antes de la versión de firmware V5.21(ABAG.4)C0. ZyXEL ha puesto a disposición actualizaciones de firmware para dispositivos NAS326, NAS520, NAS540 y NAS542. Modelos afectados que se encuentran en el final del soporte: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 y NSA325v2.", }, ], id: "CVE-2020-9054", lastModified: "2025-03-21T19:50:32.680", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "COMPLETE", baseScore: 10, confidentialityImpact: "COMPLETE", integrityImpact: "COMPLETE", vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, exploitabilityScore: 10, impactScore: 10, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }, published: "2020-03-04T20:15:10.750", references: [ { source: "cret@cert.org", tags: [ "Third Party Advisory", ], url: "https://cwe.mitre.org/data/definitions/78.html", }, { source: "cret@cert.org", tags: [ "Third Party Advisory", "US Government Resource", ], url: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, { source: "cret@cert.org", tags: [ "Third Party Advisory", "US Government Resource", ], url: "https://kb.cert.org/vuls/id/498544/", }, { source: "cret@cert.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", }, { source: "cret@cert.org", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://cwe.mitre.org/data/definitions/78.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "US Government Resource", ], url: "https://kb.cert.org/artifacts/cve-2020-9054.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "US Government Resource", ], url: "https://kb.cert.org/vuls/id/498544/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml", }, ], sourceIdentifier: "cret@cert.org", vulnStatus: "Analyzed", weaknesses: [ { description: [ { lang: "en", value: "CWE-78", }, ], source: "cret@cert.org", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-78", }, ], source: "nvd@nist.gov", type: "Primary", }, { description: [ { lang: "en", value: "CWE-78", }, ], source: "134c704f-9b21-4f2e-91b3-4a467353bcc0", type: "Secondary", }, ], }
Vulnerability from fkie_nvd
Published
2022-07-19 06:15
Modified
2024-11-21 07:02
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "168114AC-C949-4CA5-B4B4-BF9FB5890DA2", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0EFADF80-716E-4000-93D4-0CB3B277BA25", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7FABAFF3-61E8-4C97-BEFE-1D68788167FB", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "21C293BE-791E-4D1C-8E72-9E0464444274", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "5094FAF7-6D9A-44EF-B779-86468D82B03C", versionEndIncluding: "5.30", versionStartIncluding: "4.16", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*", matchCriteriaId: "110A1CA4-0170-4834-8281-0A3E14FC5584", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0EF21C51-050F-4B01-9618-60919AEFEC6A", versionEndIncluding: "5.30", versionStartIncluding: "4.16", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "50A72101-97B4-4770-A6F7-D25B3A0AE45E", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "650D7D9B-65A7-4949-9F6C-9A3B7BDD17F5", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1C376DD7-8378-42BE-92F1-872500E882D4", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F9DC83BF-6F99-4345-BE51-4FB93F38FD21", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4E464C22-5D8C-4D85-9F65-8485972C3524", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F5A44B6A-B1BC-481F-9D08-61E50F58EB1A", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DBBB154D-46EB-4D97-B5F4-01ADA359C5AC", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4D0BC145-7EF2-4B13-BE26-A567EEF06613", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "75627990-29D4-40F3-8E66-975F1898B6D5", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0F357DD8-0C9E-418E-98B4-0F1292AA7176", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "352F3388-9107-4B41-AAD8-D11965D78240", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "BC1F7BCE-342F-4847-BB89-2B47384A54C9", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "32F7F370-C585-45FE-A7F7-40BFF13928CF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F6FBACC4-A37C-4023-A656-F3428A74D542", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B1C3F76A-6963-4B2F-AAF4-9E3BBB0627D6", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "61ED5800-D09B-4953-AB0F-65AE3EF33C57", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "20E65AC2-F493-4E10-924B-3F5D5FE2B6FF", versionEndIncluding: "4.72", versionStartIncluding: "4.09", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "611A3CB1-D0ED-4B4E-A28E-D69ED31035DF", versionEndIncluding: "4.72", versionStartIncluding: "4.09", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D546A4A3-130F-439C-9C28-8D18870F0A58", versionEndIncluding: "4.72", versionStartIncluding: "4.09", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "CED1826F-286E-4795-87C4-6FFD997BDB46", versionEndIncluding: "4.72", versionStartIncluding: "4.09", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.", }, { lang: "es", value: "Se ha identificado una vulnerabilidad de escalada de privilegios en el comando CLI del firmware Zyxel USG FLEX 100(W) versiones 4.50 a 5.30, firmware USG FLEX 200 versiones 4.50 a 5.30, firmware USG FLEX 500 versiones 4.50 a 5.30, firmware USG FLEX 700 versiones 4.50 a 5.30, firmware USG FLEX 50(W) versiones 4.16 a 5. 30, firmware USG20(W)-VPN versiones 4.16 a 5.30, firmware de la serie ATP versiones 4.32 a 5.30, firmware de la serie VPN versiones 4.30 a 5.30, firmware de la serie USG/ZyWALL versiones 4.09 a 4.72, lo que podría permitir a un atacante local ejecutar algunos comandos del sistema operativo con privilegios de root en algunos directorios de un dispositivo vulnerable.", }, ], id: "CVE-2022-30526", lastModified: "2024-11-21T07:02:52.850", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-07-19T06:15:08.827", references: [ { source: "security@zyxel.com.tw", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", }, { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-269", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-269", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-07-19 06:15
Modified
2024-11-21 07:00
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "168114AC-C949-4CA5-B4B4-BF9FB5890DA2", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0EFADF80-716E-4000-93D4-0CB3B277BA25", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "7FABAFF3-61E8-4C97-BEFE-1D68788167FB", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "21C293BE-791E-4D1C-8E72-9E0464444274", versionEndIncluding: "5.30", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "E6C9ECE5-14ED-4B0C-B4FF-F00E35A9AFF0", versionEndIncluding: "5.30", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*", matchCriteriaId: "110A1CA4-0170-4834-8281-0A3E14FC5584", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F666507D-EE3E-493A-9DF5-D7773305985D", versionEndIncluding: "5.30", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "06D2AD3A-9197-487D-A267-24DE332CC66B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "50A72101-97B4-4770-A6F7-D25B3A0AE45E", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "650D7D9B-65A7-4949-9F6C-9A3B7BDD17F5", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1C376DD7-8378-42BE-92F1-872500E882D4", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F9DC83BF-6F99-4345-BE51-4FB93F38FD21", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4E464C22-5D8C-4D85-9F65-8485972C3524", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F5A44B6A-B1BC-481F-9D08-61E50F58EB1A", versionEndIncluding: "5.30", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "DBBB154D-46EB-4D97-B5F4-01ADA359C5AC", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4D0BC145-7EF2-4B13-BE26-A567EEF06613", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "75627990-29D4-40F3-8E66-975F1898B6D5", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0F357DD8-0C9E-418E-98B4-0F1292AA7176", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "352F3388-9107-4B41-AAD8-D11965D78240", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "7239C54F-EC9E-44B4-AE33-1D36E5448219", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "BC1F7BCE-342F-4847-BB89-2B47384A54C9", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*", matchCriteriaId: "32F7F370-C585-45FE-A7F7-40BFF13928CF", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "F6FBACC4-A37C-4023-A656-F3428A74D542", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B1C3F76A-6963-4B2F-AAF4-9E3BBB0627D6", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "61ED5800-D09B-4953-AB0F-65AE3EF33C57", versionEndIncluding: "5.30", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "3F486DCF-02EB-49DC-862A-3CE9B55D8210", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "94A7F2DF-F22C-49DA-9563-BAFD59011B70", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "36CDEEE3-8284-4759-9B23-72989BBABBDD", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "149EABE0-AAB1-41C2-9A34-2C25650B83BF", versionEndIncluding: "4.72", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.", }, { lang: "es", value: "Se identificó una vulnerabilidad de salto de directorio causada por secuencias de caracteres específicas dentro de una URL saneada inapropiadamente en algunos programas CGI de las versiones 4.50 a 5.30 del firmware Zyxel USG FLEX 100(W), versiones 4.50 a 5.30 del firmware USG FLEX 200, versiones 4.50 a 5.30 del firmware USG FLEX 500, versiones 4.50 a 5.30 del firmware USG FLEX 700. 30, firmware USG FLEX 50(W) versiones 4.16 a 5.30, firmware USG20(W)-VPN versiones 4.16 a 5.30, firmware de la serie ATP versiones 4.32 a 5.30, firmware de la serie VPN versiones 4.30 a 5.30, firmware de la serie USG/ZyWALL versiones 4.11 a 4.72, que podría permitir a un atacante autenticado acceder a algunos archivos restringidos en un dispositivo vulnerable.\n", }, ], id: "CVE-2022-2030", lastModified: "2024-11-21T07:00:12.173", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-07-19T06:15:08.383", references: [ { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-22", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-22", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2022-03-28 13:15
Modified
2024-11-21 06:38
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "446021BD-AEA3-47E8-BF5D-6C649012E84D", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*", matchCriteriaId: "5CCD2777-CC85-4BAA-B16B-19C2DB8DB742", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B57804DF-D913-4300-8744-81DB99621240", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*", matchCriteriaId: "0906F3FA-793B-421D-B957-7E9C18C1AEC0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D9ED6C58-3BF5-424F-AFB1-F6955F3488BB", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*", matchCriteriaId: "26900300-1325-4C8A-BC3B-A10233B2462A", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "4FB78B59-C4C7-4595-9221-DDC0DCE09BB0", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*", matchCriteriaId: "A5A7555E-BC29-460C-A701-7DCDEAFE67F3", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "77FEF751-62FE-4F1B-A84C-30967A605EF5", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*", matchCriteriaId: "145E41D9-E376-4B8E-A34F-F2C7ECFD649D", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "E46647BB-F930-4648-A25D-C18D71D7A434", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*", matchCriteriaId: "B40C703E-C7C0-4B49-A336-83853D3E8C31", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "E2755DDA-287F-4C79-B663-C5DA9DBC5052", versionEndExcluding: "4.71", versionStartIncluding: "4.20", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*", matchCriteriaId: "BCE32A1C-A730-4893-BCB9-F753F8E65440", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "293C6F8B-51F7-44A5-ACAD-10586C9EB610", versionEndIncluding: "5.20", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100:-:*:*:*:*:*:*:*", matchCriteriaId: "2B30A4C0-9928-46AD-9210-C25656FB43FB", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B4F8A08F-8531-444E-BE70-6C0096BE8CAC", versionEndIncluding: "5.20", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", matchCriteriaId: "F93B6A06-2951-46D2-A7E1-103D7318D612", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "8553EF99-5F25-4F96-840C-1D5146C9CAF9", versionEndIncluding: "5.20", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", matchCriteriaId: "92C697A5-D1D3-4FF0-9C43-D27B18181958", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "05959C9F-4209-4B0B-81DD-6C98BFC43F7B", versionEndIncluding: "5.20", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", matchCriteriaId: "D74ABA7E-AA78-4A13-A64E-C44021591B42", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "2C2F72A1-7D2D-4BC3-8440-937435507F5C", versionEndIncluding: "5.20", versionStartIncluding: "4.50", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", matchCriteriaId: "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "724173AB-0DA0-4EFE-A011-FAEF14A95D2A", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", matchCriteriaId: "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "A589B630-B42D-4BD5-BBBD-E71C8B5456B8", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", matchCriteriaId: "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "14B0DB32-9453-47D8-8024-E6C8505DB617", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", matchCriteriaId: "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D5E79634-60EC-4548-B8BC-61E5560CBE75", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", matchCriteriaId: "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "BACE4393-DE77-4CE1-A453-B155A3CF9A7C", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", matchCriteriaId: "0B41F437-855B-4490-8011-DF59887BE6D5", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "1D3DC512-0DE4-42DB-AD0C-240AB1B901B1", versionEndIncluding: "5.20", versionStartIncluding: "4.32", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", matchCriteriaId: "66B99746-0589-46E6-9CBD-F38619AD97DC", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "62B6CADB-1FB0-4442-A116-055636AB6ECA", versionEndExcluding: "5.21", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", matchCriteriaId: "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "D1265B3B-7C70-46C0-8E0C-1C05C7EF99EE", versionEndExcluding: "5.21", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", matchCriteriaId: "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "B770A62D-3B2C-4B91-BB8E-4F36D3F20C9C", versionEndExcluding: "5.21", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", matchCriteriaId: "3C45C303-1A95-4245-B242-3AB9B9106CD4", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0C509426-81BE-46AB-B083-DEA0DC762C85", versionEndExcluding: "5.21", versionStartIncluding: "4.30", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", matchCriteriaId: "EECD311A-4E96-4576-AADF-47291EDE3559", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:zyxel:nsg300_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "40E88F87-44B1-4104-A8EB-3BC4A0BA3A45", versionEndExcluding: "1.33", versionStartIncluding: "1.20", vulnerable: true, }, { criteria: "cpe:2.3:o:zyxel:nsg300_firmware:1.33:-:*:*:*:*:*:*", matchCriteriaId: "D43F6C03-E7EE-43B9-81B7-2B298134A591", vulnerable: true, }, { criteria: "cpe:2.3:o:zyxel:nsg300_firmware:1.33:p4:*:*:*:*:*:*", matchCriteriaId: "97697676-94E6-4A6A-B9FB-07D8DD48BA06", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:zyxel:nsg300:-:*:*:*:*:*:*:*", matchCriteriaId: "58B0886D-9AF4-453F-96DB-7ABAA5EE3B78", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.", }, { lang: "es", value: "Una vulnerabilidad de omisión de autenticación en el programa CGI de USG/ZyWALL de Zyxel versiones de firmware de las series 4.20 a 4.70, las versiones de firmware de la serie USG FLEX 4.50 a 5.20, las versiones de firmware de la serie ATP 4.32 a 5.20, las versiones de firmware de la serie VPN 4.30 a 5.20 y las versiones de firmware de la serie NSG V1.20 a V1.33 Parche 4, que podría permitir a un atacante omitir la autenticación web y obtener acceso administrativo al dispositivo", }, ], id: "CVE-2022-0342", lastModified: "2024-11-21T06:38:25.003", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "security@zyxel.com.tw", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2022-03-28T13:15:07.747", references: [ { source: "security@zyxel.com.tw", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml", }, ], sourceIdentifier: "security@zyxel.com.tw", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-287", }, ], source: "security@zyxel.com.tw", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-287", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }