Cross site scripting

2019-06-2715:15:00

PRIOn knowledge base

www.prio-n.com

0.004 Low

EPSS

Percentile

71.9%

JSON

A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.

CPENameOperatorVersion
uag2100_firmwareeq<= 4.18aaiz.1c0
uag4100_firmwareeq<= 4.18aatd.1c0
uag5100_firmwareeq<= 4.18aapn.1c0
usg1100_firmwarele4.30
usg110_firmwarele4.30
usg1900_firmwarele4.30
usg210_firmwarele4.30
usg2200-vpn_firmwarele4.30
usg310_firmwarele4.30

Name	Operator	Version
uag2100_firmware	eq	<= 4.18aaiz.1c0
uag4100_firmware	eq	<= 4.18aatd.1c0
uag5100_firmware	eq	<= 4.18aapn.1c0
usg1100_firmware	le	4.30
usg110_firmware	le	4.30
usg1900_firmware	le	4.30
usg210_firmware	le	4.30
usg2200-vpn_firmware	le	4.30
usg310_firmware	le	4.30