Lucene search

[email protected]CVE-2022-0342

HistoryMar 28, 2022 - 1:15 p.m.

CVE-2022-0342

2022-03-2813:15:07

CWE-287

[email protected]

web.nvd.nist.gov

cve-2022-0342

zyxel

authentication bypass

vulnerability

firmware

cgi program

usg

zywall

atp

vpn

nsg

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.08 Low

EPSS

Percentile

94.3%

JSON

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Affected configurations

NVD

Node

zyxelusg40_firmwareRange4.20–4.71

AND

zyxelusg40Match-

Node

zyxelusg40w_firmwareRange4.20–4.71

AND

zyxelusg40wMatch-

Node

zyxelusg60_firmwareRange4.20–4.71

AND

zyxelusg60Match-

Node

zyxelusg60w_firmwareRange4.20–4.71

AND

zyxelusg60wMatch-

Node

zyxelzywall_110_firmwareRange4.20–4.71

AND

zyxelzywall_110Match-

Node

zyxelzywall_310_firmwareRange4.20–4.71

AND

zyxelzywall_310Match-

Node

zyxelzywall_1100_firmwareRange4.20–4.71

AND

zyxelzywall_1100Match-

Node

zyxelusg_flex_100_firmwareRange4.50–5.20

AND

zyxelusg_flex_100Match-

Node

zyxelusg_flex_200_firmwareRange4.50–5.20

AND

zyxelusg_flex_200Match-

Node

zyxelusg_flex_500Match-

AND

zyxelusg_flex_500_firmwareRange4.50–5.20

Node

zyxelusg_flex_100wMatch-

AND

zyxelusg_flex_100w_firmwareRange4.50–5.20

Node

zyxelusg_flex_700_firmwareRange4.50–5.20

AND

zyxelusg_flex_700Match-

Node

zyxelatp100_firmwareRange4.32–5.20

AND

zyxelatp100Match-

Node

zyxelatp100w_firmwareRange4.32–5.20

AND

zyxelatp100wMatch-

Node

zyxelatp200_firmwareRange4.32–5.20

AND

zyxelatp200Match-

Node

zyxelatp500_firmwareRange4.32–5.20

AND

zyxelatp500Match-

Node

zyxelatp700_firmwareRange4.32–5.20

AND

zyxelatp700Match-

Node

zyxelatp800Match-

AND

zyxelatp800_firmwareRange4.32–5.20

Node

zyxelvpn50Match-

AND

zyxelvpn50_firmwareRange4.30–5.21

Node

zyxelvpn100Match-

AND

zyxelvpn100_firmwareRange4.30–5.21

Node

zyxelvpn300Match-

AND

zyxelvpn300_firmwareRange4.30–5.21

Node

zyxelvpn1000Match-

AND

zyxelvpn1000_firmwareRange4.30–5.21

Node

zyxelnsg300Match-

AND

zyxelnsg300_firmwareRange1.20–1.33

zyxelnsg300_firmwareMatch1.33-

zyxelnsg300_firmwareMatch1.33p4

CPENameOperatorVersion
zyxel:usg40_firmwarezyxel usg40 firmwarelt4.71

CPE	Name	Operator	Version
zyxel:usg40_firmware	zyxel usg40 firmware	lt	4.71

CNA Affected

[
  {
    "product": "USG/ZyWALL series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.20 through 4.70"
      }
    ]
  },
  {
    "product": "USG FLEX series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.50 through 5.20"
      }
    ]
  },
  {
    "product": "ATP series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.32 through 5.20"
      }
    ]
  },
  {
    "product": "VPN series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.30 through 5.20"
      }
    ]
  },
  {
    "product": "NSG series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.20 through 1.33 Patch 4"
      }
    ]
  }
]

References

www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.08 Low

EPSS

Percentile

94.3%

JSON

Related for CVE-2022-0342

cvelist1 nuclei1 nvd1 prion1 hivepro2 malwarebytes1 thn1