Medium severity6.1NVD Advisory· Published Sep 3, 2024· Updated Jun 17, 2026

CVE-2024-42061

Description

A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zyxel/Zld
cpe:2.3:o:zyxel:zld:*:*:*:*:*:*:*:*
Range: >=4.32,<5.39
Zyxel/ATP series firmwarellm-fuzzy
Range: V4.32 - V5.38
Zyxel/USG FLEX series firmwarellm-fuzzy
Range: V4.50 - V5.38
Zyxel/USG20(W)-VPN series firmwarellm-fuzzy
Range: V4.16 - V5.38
Zyxel/ATP seriescpe-rescue
Range: versions V4.32 through V5.38
Zyxel/USG FLEX seriescpe-rescue2 versions
versions V4.16 through V5.38+ 1 more
- (no CPE)range: versions V4.16 through V5.38
- (no CPE)range: versions V4.50 through V5.38
Zyxel/USG20(W)-VPN seriescpe-rescue
Range: versions V4.16 through V5.38

Patches

Vulnerability mechanics

References

www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000