CVE-2022-0910

CWE-287 — Improper Authentication3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 64.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
36
Zyxel Atp100 FirmwareZyxel Atp100w FirmwareZyxel Atp200 Firmware+33 more
Timeline
PublishedMay 24
Latest updateMay 25

Description

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages36 packages

▶CVEListV5zyxel/usg_flex_series_firmware4.50 through 5.21
▶CVEListV5zyxel/usg/zywall_series_firmware4.32 through 4.71
▶CVEListV5zyxel/atp_series_firmware4.32 through 5.21
▶CVEListV5zyxel/vpn_series_firmware4.32 through 5.21
▶NVDzyxel/usg_flex_100_firmware4.50 — 5.21

🔴Vulnerability Details

2
GHSA
GHSA-mv2h-6cx9-44g2: A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions↗2022-05-25
▶
CVEList
CVE-2022-0910: A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions↗2022-05-24
▶
CVE-2022-0910 (MEDIUM CVSS 6.5) | A downgrade from two-factor authent | cvebase.io