CVE-2022-0734

State: Published
Severity: 5.8 Medium
Published: May 24, 2022
Updated: Aug 2, 2024
Reserved: Feb 23, 2022

Description

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.

Scores

CVSS	Score	Vector	Source
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	Zyxel

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
USG/ZyWALL series firmwareZyxel	4.35 through 4.70Affected
USG FLEX series firmwareZyxel	4.50 through 5.20Affected
ATP series firmwareZyxel	4.35 through 5.20Affected
VPN series firmwareZyxel	4.35 through 5.20Affected

References

https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.