CVE-2019-9955
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
- Score
- CVSS 3.0 6.1 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2019-04-22
- Last modified
- 2024-08-04
- Weaknesses
- CWE-79
Affected products
- Atp200 Firmware (Zyxel)
- Atp500 Firmware (Zyxel)
- Atp800 Firmware (Zyxel)
- Usg1100 Firmware (Zyxel)
- Usg110 Firmware (Zyxel)
- Usg1900 Firmware (Zyxel)
- Usg20-vpn Firmware (Zyxel)
- Usg20w-vpn Firmware (Zyxel)
- Usg210 Firmware (Zyxel)
- Usg2200-vpn Firmware (Zyxel)
- Usg310 Firmware (Zyxel)
- Usg40 Firmware (Zyxel)
- Usg40w Firmware (Zyxel)
- Usg60 Firmware (Zyxel)
- Usg60w Firmware (Zyxel)
- Vpn100 Firmware (Zyxel)
- Vpn300 Firmware (Zyxel)
- Vpn50 Firmware (Zyxel)
- Zywall 1100 Firmware (Zyxel)
- Zywall 110 Firmware (Zyxel)
- Zywall 310 Firmware (Zyxel)
References
- http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2019/Apr/22
- https://www.exploit-db.com/exploits/46706/
- https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page
- https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml
