by Kastro
Paper/Archive/CVE-2022-0342

CVE-2022-0342

Zyxel USG/ZyWALL series firmware — An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series…

EPSS 95%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Affected

ProductAffectedFixed inSource
USG/ZyWALL series firmware4.20 through 4.70–CNA
USG FLEX series firmware4.50 through 5.20–CNA
ATP series firmware4.32 through 5.20–CNA
VPN series firmware4.30 through 5.20–CNA
NSG series firmware1.20 through 1.33 Patch 4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zyxel (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refzyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml