CVE-2021-46387

Vulnerability

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by a Cross-Site Scripting (XSS) vulnerability due to insecure URI handling. The vulnerability allows bypassing security restrictions, enabling an attacker to inject arbitrary JavaScript. Affected versions are not explicitly listed in the available references, but the device itself is the subject of the advisory [1][2].

Exploitation

An attacker must trick an authenticated user into clicking a crafted link that contains malicious JavaScript in the URI. No other authentication or network position is required beyond the ability to deliver the link to a user who is logged into the appliance's management interface [1].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's session, leading to clipboard hijacking and session hijacking [1]. The attacker can potentially perform any action available to the victim, including configuration changes or data exfiltration.

Mitigation

As of the publication date (2022-03-01), no fixed version is mentioned in the available references [1][2]. Users are advised to monitor vendor advisories for a patch and to restrict access to the management interface as a workaround.