What is the CVSS score of CVE-2022-0342?

CVE-2022-0342 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 84.8%.

Is there a public PoC exploit available for CVE-2022-0342?

Yes, a public proof-of-concept exploit is available for CVE-2022-0342. Prioritise patching immediately. EPSS: 84.8%.

Zywall 110 Firmware CVE-2022-0342

CRITICAL

Improper Authentication (CWE-287)

2022-03-28 security@zyxel.com.tw

Authentication Bypass Zyxel Zywall 110 Firmware Zywall 1100 Firmware Zywall 310 Firmware Atp200 Firmware Atp500 Firmware Atp800 Firmware Usg40 Firmware Usg40W Firmware Usg60 Firmware Usg60W Firmware Vpn50 Firmware Vpn100 Firmware Vpn300 Firmware Atp100 Firmware Vpn1000 Firmware Atp100W Firmware Atp700 Firmware Usg Flex 100 Firmware Usg Flex 100W Firmware Usg Flex 200 Firmware Usg Flex 500 Firmware Usg Flex 700 Firmware Nsg300 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 28, 2022 - 13:15 nvd

CRITICAL 9.8

DescriptionNVD

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

AnalysisAI

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device. Affected products include: Zyxel Usg40 Firmware, Zyxel Usg40W Firmware, Zyxel Usg60 Firmware, Zyxel Usg60W Firmware, Zyxel Zywall 110 Firmware. Version information: through 4.70.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.