CVE-2022-40603: XSS

Q: What is CVE-2022-40603?

CVE-2022-40603 is a cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware.

Q: What is the severity of CVE-2022-40603?

CVE-2022-40603 has a severity level of 6.1 (medium).

Q: How can I fix CVE-2022-40603?

Update the affected firmware versions to the latest ones provided by Zyxel.

Q: Where can I find more information about CVE-2022-40603?

You can find more information about CVE-2022-40603 on Zyxel's official security advisories page: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls

Published Dec 6, 2022

Updated

A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.

Affected Software

38 affected components

Zyxel Atp800 Firmware>=4.32<=5.31

Zyxel ATP800

Zyxel Atp700 Firmware>=4.32<=5.31

Zyxel Atp700

Zyxel Atp500 Firmware>=4.32<=5.31

Zyxel ATP500

Zyxel Atp200 Firmware>=4.32<=5.31

Zyxel ATP200

Zyxel Atp100 Firmware>=4.32<=5.31

Zyxel Atp100

Zyxel Atp100w Firmware>=4.32<=5.31

Zyxel Atp100w

Zyxel Usg Flex 100w Firmware>=4.50<=5.31

Zyxel Usg Flex 100w

Zyxel USG FLEX 200 firmware>=4.50<=5.31

Zyxel USG FLEX 200

Zyxel USG FLEX 500 firmware>=4.50<=5.31

Zyxel USG FLEX 500

Zyxel USG FLEX 700 firmware>=4.50<=5.31

Zyxel USG FLEX 700

Zyxel Usg Flex 50w Firmware>=4.50<=5.31

Zyxel Usg Flex 50w

Zyxel Vpn1000 Firmware>=4.30<=5.31

Zyxel Vpn1000

Zyxel Vpn300 Firmware>=4.30<=5.31

Zyxel Vpn300

Zyxel Vpn100 Firmware>=4.30<=5.31

Zyxel Vpn100

Zyxel Vpn50 Firmware>=4.30<=5.31

Zyxel Vpn50

Zyxel Usg40 Firmware>=4.30<=4.72

Zyxel USG40

Zyxel Usg40w Firmware>=4.30<=4.72

Zyxel USG40W

Zyxel Usg60 Firmware>=4.30<=4.72

Zyxel USG60

Zyxel Usg60w Firmware>=4.30<=4.72

Zyxel USG60W

Event History

Dec 6, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-40603?

CVE-2022-40603 is a cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware.

Which Zyxel products are affected by CVE-2022-40603?

Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31 are affected.

What is the severity of CVE-2022-40603?

CVE-2022-40603 has a severity level of 6.1 (medium).

How can I fix CVE-2022-40603?

Update the affected firmware versions to the latest ones provided by Zyxel.

Where can I find more information about CVE-2022-40603?