The vulnerability of the microprogramming software used in Zyxel Ethernet switches such as ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 lies in the lack of protective measures for website structures. This allows attackers to carry out cross-site scripting attacks.

🗓️ 17 Dec 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 66 Views

Zyxel microprogramming software permits cross-site scripting from website structure mp_idx.

Reporter	Title	Published	Views	Family All 10
zdt	Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting	16 Apr 201900:00	–	zdt
CNVD	Cross-Site Scripting Vulnerabilities in Multiple ZyXEL Products	17 Apr 201900:00	–	cnvd
CVE	CVE-2019-9955	22 Apr 201919:38	–	cve
Cvelist	CVE-2019-9955	22 Apr 201919:38	–	cvelist
Exploit DB	Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting	16 Apr 201900:00	–	exploitdb
Nuclei	Zyxel - Cross-Site Scripting	17 Aug 202603:58	–	nuclei
NVD	CVE-2019-9955	22 Apr 201920:29	–	nvd
OSV	CVE-2019-9955	22 Apr 201920:29	–	osv
Packet Storm	Zyxel ZyWall Cross Site Scripting	16 Apr 201900:00	–	packetstorm
Prion	Cross site scripting	22 Apr 201920:29	–	prion

Vulners

Node

OR

zyxel_communications atp200Match4.31

zyxel_communications atp500Match4.31

zyxel_communications atp800Match4.31

zyxel_communications usg20-vpnMatch4.31

zyxel_communications usg20w-vpnMatch4.31

zyxel_communications usg40Match4.31

zyxel_communications usg40wMatch4.31

zyxel_communications usg60Match4.31

zyxel_communications usg60wMatch4.31

zyxel_communications usg110Match4.31

zyxel_communications usg210Match4.31

zyxel_communications usg310Match4.31

zyxel_communications usg1100Match4.31

zyxel_communications usg2200-vpnMatch4.31

zyxel_communications zywall_110Match4.31

zyxel_communications zywall_310Match4.31

zyxel_communications zywall_1100Match4.31

Source	Link
cxsecurity	www.cxsecurity.com/cveshow/CVE-2019-9955/
packetstormsecurity	www.packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html
seclists	www.seclists.org/fulldisclosure/2019/Apr/22
exploit-db	www.exploit-db.com/exploits/46706/
securitymetrics	www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page
zyxel	www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml
web	www.web.nvd.nist.gov/view/vuln/detail

17 Dec 2019 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 36.1

EPSS0.20861

Zyxel devices Cross-site scripting Website structure Mp index parameter