CVE-2022-0734

moderate-risk

Published 2022-05-24

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.

Do I need to act?

0.33% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.8/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Vpn100 Firmware

Vpn1000 Firmware

Vpn300 Firmware

Vpn50 Firmware

Atp100 Firmware

Atp100W Firmware

Atp200 Firmware

Atp500 Firmware

Atp700 Firmware

Atp800 Firmware

Usg 110 Firmware

Usg 1100 Firmware

Usg 1900 Firmware

Usg 20W Firmware

Usg 20W-Vpn Firmware

Usg 2200-Vpn Firmware

Usg 310 Firmware

Usg 40 Firmware

Usg 40W Firmware

Usg 60 Firmware

Affected Vendors

Zyxel

References (2)

Vendor Advisory https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controlle...

/ 100

moderate-risk

Severity 22/34 · High

Exploitability 1/34 · Minimal

Exposure 23/34 · High