CVE-2021-46387
moderate-risk
Published 2022-03-01
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.
Do I need to act?
!
28.5% chance of exploitation in next 30 days
EPSS score — higher than 72% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10
Medium
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
References (8)
Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtml
Vendor Advisory
https://www.zyxel.com/us/en/support/security_advisories.shtml
43
/ 100
moderate-risk
Severity
23/34 · High
Exploitability
15/34 · Moderate
Exposure
5/34 · Minimal