CVE-2022-40603

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the CGI program of certain Zyxel firewall series. Affected firmware versions include ZyWALL/USG series ZLD 4.30 through 4.72, VPN series ZLD 4.30 through 5.31, USG FLEX series ZLD 4.50 through 5.31, and ATP series ZLD 4.32 through 5.31 [1]. The vulnerability allows an attacker to inject malicious scripts via a crafted URL.

Exploitation

An attacker must craft a URL containing the XSS payload and trick a user into visiting it (e.g., via phishing). No special network position or authentication is required beyond the user's interaction. Once the victim accesses the malicious URL, the CGI program processes the payload, and the script executes in the context of the user's browser session.

Impact

If the malicious script executes on the victim's browser, the attacker can gain access to sensitive browser-based information, such as session cookies, authentication tokens, or other data accessible to the same origin. The attacker's access is limited to the victim's privilege level within the firewall's web interface.

Mitigation

Zyxel has released patches for all affected series: ATP, USG FLEX, and VPN firmware updated to ZLD V5.32; ZyWALL/USG firmware updated to ZLD V4.73 [1]. Users are advised to apply the updates. No workarounds have been provided. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.