An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series f…

published 2022-03-28 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15502

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 95.1%; EPSS 95.1% chance of exploitation in 30 days, percentile 99.8%
public exploits: 0; none known, plus a Nuclei check

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Patch / fix

fixed in 12

zyxel usg40_firmware 4.71
zyxel usg40w_firmware 4.71
zyxel usg60_firmware 4.71
zyxel usg60w_firmware 4.71
zyxel zywall_110_firmware 4.71
zyxel zywall_310_firmware 4.71
zyxel zywall_1100_firmware 4.71
zyxel vpn50_firmware 5.21
zyxel vpn100_firmware 5.21
zyxel vpn300_firmware 5.21
zyxel vpn1000_firmware 5.21
zyxel nsg300_firmware 1.33

Exploit prediction

95.13% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template Zyxel - Authentication Bypass nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Zyxel USG/ZyWALL series firmware
Zyxel USG FLEX series firmware
Zyxel ATP series firmware
Zyxel VPN series firmware
Zyxel NSG series firmware

Classification

Weakness

CWE-287 Improper Authentication

References

zyxel.com /support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
vendor-advisory

Sources

CVE List CVE-2022-0342
NVD CVE-2022-0342

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary