VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 3, 2024· Updated Sep 3, 2024

CVE-2024-42061

CVE-2024-42061

Description

A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Zyxel/ATP seriesllm-fuzzy2 versions
    >= V4.32 <= V5.38+ 1 more
    • (no CPE)range: >= V4.32 <= V5.38
    • (no CPE)range: versions V4.32 through V5.38
  • Zyxel/USG FLEX seriesllm-fuzzy3 versions
    >= V4.50 <= V5.38+ 2 more
    • (no CPE)range: >= V4.50 <= V5.38
    • (no CPE)range: versions V4.16 through V5.38
    • (no CPE)range: versions V4.50 through V5.38
  • Zyxel/USG20(W)-VPN seriesllm-fuzzy2 versions
    >= V4.16 <= V5.38+ 1 more
    • (no CPE)range: >= V4.16 <= V5.38
    • (no CPE)range: versions V4.16 through V5.38

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.