9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
THREAT LEVEL: Amber For a detailed advisory, download the pdf file here A severe vulnerability (CVE-2022-0342) has been discovered in the firmware of some of Zyxel's business-grade firewall and VPN products, potentially allowing attackers administrator-level access to affected devices. This vulnerability affects the USG/ZyWALL, USG FLEX, ATP, VPN, and NSG (Nebula Security Gateway) range of Zyxel products. This is an authentication bypass vulnerability (CVE-2022-0342) discovered in the CGI program of some firewall versions due to a lack of a proper access control mechanism. An attacker could use this flaw to circumvent authentication and get administrative access to the device. For optimal protection, we suggest organizations to update the firmware of their products according to the information given below. Potential MITRE ATT&CK TTPs are: TA0001: Initial Access TA0002: Execution TA0004: Privilege Escalation TA0005: Defense Evasion TA0006: Credential Access TA0007: Discovery TA0042: Resource Development T1040: Network Sniffing T1588: Obtain Capabilities T1588.006: Obtain Capabilities: Vulnerabilities T1548: Abuse Elevation Control Mechanism T1190: Exploit Public-Facing Application Vulnerability Details Affected Products Patch Links https://support.zyxel.eu/hc/en-us/articles/4672704562578-USG-FLEX-ATP-Series-Firmware-Update-5-21-Patch-1-Installation-Notes References https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P