CVE-2022-0910

State: Published
Severity: 6.5 Medium
Published: May 24, 2022
Updated: Aug 2, 2024
Reserved: Mar 10, 2022

Description

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	Zyxel

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
USG/ZyWALL series firmwareZyxel	4.32 through 4.71Affected
USG FLEX series firmwareZyxel	4.50 through 5.21Affected
ATP series firmwareZyxel	4.32 through 5.21Affected
VPN series firmwareZyxel	4.32 through 5.21Affected

References

https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.