CVE-2022-0342
9.8
CRITICAL · CVSS 3.1 · EPSS 95.1% (pctl 100)
Patch early
EPSS 95.1% — above the 10% action threshold.
Description
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 95.13% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-03-28 |
| Last modified | 2026-06-17 |
Affected (40)
| Vendor | Product |
|---|---|
| zyxel | atp100 |
| zyxel | atp100 firmware |
| zyxel | atp100w |
| zyxel | atp100w firmware |
| zyxel | atp200 |
| zyxel | atp200 firmware |
| zyxel | atp500 |
| zyxel | atp500 firmware |
| zyxel | atp700 |
| zyxel | atp700 firmware |
| zyxel | atp800 |
| zyxel | atp800 firmware |
| zyxel | usg flex 100 |
| zyxel | usg flex 100 firmware |
| zyxel | usg flex 100w |
| zyxel | usg flex 100w firmware |
| zyxel | usg flex 200 |
| zyxel | usg flex 200 firmware |
| zyxel | usg flex 500 |
| zyxel | usg flex 500 firmware |
| zyxel | usg flex 700 |
| zyxel | usg flex 700 firmware |
| zyxel | usg40 |
| zyxel | usg40 firmware |
| zyxel | usg40w |
| zyxel | usg40w firmware |
| zyxel | usg60 |
| zyxel | usg60 firmware |
| zyxel | usg60w |
| zyxel | usg60w firmware |
| zyxel | vpn100 |
| zyxel | vpn100 firmware |
| zyxel | vpn50 |
| zyxel | vpn50 firmware |
| zyxel | zywall 110 |
| zyxel | zywall 110 firmware |
| zyxel | zywall 1100 |
| zyxel | zywall 1100 firmware |
| zyxel | zywall 310 |
| zyxel | zywall 310 firmware |
References
→ the Explorer · watch your stack · NVD