CVE-2022-0734 Cross-site scripting in ATP series firmware

Medium 5.8 Published 24 May 2022 Updated 2 Aug 2024

An attacker can execute malicious scripts to steal cookies or session tokens from users interacting with the Zyxel firewall's CGI program.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0734?

CVE-2022-0734 is a medium-severity cross-site scripting vulnerability in Zyxel ATP series firmware, published on 24 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.

Weakness: CWE-79

Which versions are affected by CVE-2022-0734?

It affects 32 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 26 more.

How do I fix CVE-2022-0734?

No fix has been published for CVE-2022-0734 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-0734 being exploited?

There is no known exploitation of CVE-2022-0734 in the wild and no public exploit code.

Sources

Also known as GHSA-3mfr-f8f8-px3w.