CVE-2022-0910

moderate-risk

Published 2022-05-24

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Do I need to act?

0.15% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Vpn100 Firmware

Vpn1000 Firmware

Vpn300 Firmware

Vpn50 Firmware

Atp100 Firmware

Atp100W Firmware

Atp200 Firmware

Atp500 Firmware

Atp700 Firmware

Atp800 Firmware

Usg 110 Firmware

Usg 1100 Firmware

Usg 1900 Firmware

Usg 20W Firmware

Usg 20W-Vpn Firmware

Usg 2200-Vpn Firmware

Usg 310 Firmware

Usg 40 Firmware

Usg 40W Firmware

Usg 60 Firmware

Affected Vendors

Zyxel

References (2)

Vendor Advisory https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controlle...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 23/34 · High