PT-2019-4138 · Zyxel · Zyxel Usg60+14

Aaron Bishop

·

Published

2019-04-16

·

Updated

2019-04-30

·

CVE-2019-9955

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 (affected versions not specified)
Description The issue is related to the lack of protection of the web page structure in Zyxel firewalls, allowing a remote attacker to perform a cross-site scripting attack using the mp idx parameter. This can lead to Reflected XSS on the Zyxel login page.
Recommendations For Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, consider disabling access to the vulnerable login page until a patch is available. As a temporary workaround, avoid using the mp idx parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-04718
CVE-2019-9955

Affected Products

Zywall 110
Zywall 1100
Zywall 310
Zyxel Atp200
Zyxel Atp500
Zyxel Atp800
Zyxel Usg110
Zyxel Usg1100
Zyxel Usg1900
Zyxel Usg20(W)-Vpn
Zyxel Usg210
Zyxel Usg2200-Vpn
Zyxel Usg310
Zyxel Usg40
Zyxel Usg60