CVE-2021-46387 EXPLOIT
6.1
MEDIUM · CVSS 3.1 · EPSS 21% (pctl 97)
Patch early
A public exploit exists.
Description
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.
Scoring
| CVSS | 6.1 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 20.96% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-03-01 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| zyxel | zywall 2 plus internet security appliance |
| zyxel | zywall 2 plus internet security appliance firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) | 2022-03-02 |
References
- http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
- https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing
- https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml
- https://www.zyxel.com/us/en/support/security_advisories.shtml
- http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
- https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing
- https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml
- https://www.zyxel.com/us/en/support/security_advisories.shtml
→ the Explorer · watch your stack · NVD