CVE-2022-0342

🗓️ 28 Mar 2022 12:05:11Reported by ZyxelType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 203 Views🌐 WEB

CVE-2022-0342 Authentication bypass vulnerability in Zyxel device

Reporter	Title	Published	Views	Family All 20
attackerkb	CVE-2022-0342	28 Mar 202213:15	–	attackerkb
BDU FSTEC	CGI Interface Authentication Bypass Privilege Escalation	4 Apr 202200:00	–	bdu_fstec
Circl	CVE-2022-0342	28 Mar 202216:39	–	circl
CNNVD	Zyxel USG/ZyWALL authorization issue vulnerability	28 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-0342	28 Mar 202212:05	–	cvelist
hivepro	Weekly Threat Digest: 28 March – 3 April 2022	5 Apr 202210:11	–	hivepro
hivepro	Authentication Bypass Vulnerability in Zyxel Firmware	2 Apr 202200:44	–	hivepro
KittySploit	Zyxel Firewall Auth Bypass (CVE-2022-0342)	5 Oct 202614:20	–	kittysploit
KittySploit	Zyxel - Authentication Bypass Detection	28 Jul 202611:27	–	kittysploit
Malwarebytes	Update now! Zyxel patches critical firewall bypass vulnerability	4 Apr 202210:22	–	malwarebytes

NVD

Vulners

Node

AND

zyxel usg40_firmwareRange4.20–4.71

zyxel usg40Match-

Node

AND

zyxel usg40w_firmwareRange4.20–4.71

zyxel usg40wMatch-

Node

AND

zyxel usg60_firmwareRange4.20–4.71

zyxel usg60Match-

Node

AND

zyxel usg60w_firmwareRange4.20–4.71

zyxel usg60wMatch-

Node

AND

zyxel zywall_110_firmwareRange4.20–4.71

zyxel zywall_110Match-

Node

AND

zyxel zywall_310_firmwareRange4.20–4.71

zyxel zywall_310Match-

Node

AND

zyxel zywall_1100_firmwareRange4.20–4.71

zyxel zywall_1100Match-

Node

AND

zyxel usg_flex_100_firmwareRange4.50–5.20

zyxel usg_flex_100Match-

Node

AND

zyxel usg_flex_200_firmwareRange4.50–5.20

zyxel usg_flex_200Match-

Node

AND

zyxel usg_flex_500_firmwareRange4.50–5.20

zyxel usg_flex_500Match-

Node

AND

zyxel usg_flex_100w_firmwareRange4.50–5.20

zyxel usg_flex_100wMatch-

Node

AND

zyxel usg_flex_700_firmwareRange4.50–5.20

zyxel usg_flex_700Match-

Node

AND

zyxel atp100_firmwareRange4.32–5.20

zyxel atp100Match-

Node

AND

zyxel atp100w_firmwareRange4.32–5.20

zyxel atp100wMatch-

Node

AND

zyxel atp200_firmwareRange4.32–5.20

zyxel atp200Match-

Node

AND

zyxel atp500_firmwareRange4.32–5.20

zyxel atp500Match-

Node

AND

zyxel atp700_firmwareRange4.32–5.20

zyxel atp700Match-

Node

AND

zyxel atp800_firmwareRange4.32–5.20

zyxel atp800Match-

Node

AND

zyxel vpn50_firmwareRange4.30–5.21

zyxel vpn50Match-

Node

AND

zyxel vpn100_firmwareRange4.30–5.21

zyxel vpn100Match-

Node

AND

zyxel vpn300_firmwareRange4.30–5.21

zyxel vpn300Match-

Node

AND

zyxel vpn1000_firmwareRange4.30–5.21

zyxel vpn1000Match-

Node

AND

zyxel nsg300_firmwareRange1.20–1.33

zyxel nsg300_firmwareMatch1.33-

zyxel nsg300_firmwareMatch1.33p4

zyxel nsg300Match-

[
  {
    "product": "USG/ZyWALL series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.20 through 4.70"
      }
    ]
  },
  {
    "product": "USG FLEX series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.50 through 5.20"
      }
    ]
  },
  {
    "product": "ATP series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.32 through 5.20"
      }
    ]
  },
  {
    "product": "VPN series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "4.30 through 5.20"
      }
    ]
  },
  {
    "product": "NSG series firmware",
    "vendor": "Zyxel",
    "versions": [
      {
        "status": "affected",
        "version": "1.20 through 1.33 Patch 4"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml

Parameter	Position	Path	Description	CWE
category	query param	/cgi-bin/export-cgi?category=config&arg0=startup-config.conf	An authentication bypass vulnerability in the CGI program allows unauthenticated access to the export-cgi endpoint, potentially leaking the startup-config.conf file containing administrative credentials.	CWE-287
arg0	query param	/cgi-bin/export-cgi?category=config&arg0=startup-config.conf	An authentication bypass vulnerability in the CGI program allows unauthenticated access to the export-cgi endpoint, potentially leaking the startup-config.conf file containing administrative credentials.	CWE-287