CVE-2022-0910 Auth bypass in ATP series firmware

Medium 6.5 Published 24 May 2022 Updated 2 Aug 2024

Authenticated attackers can bypass two-factor authentication to access IPsec VPN servers on Zyxel firewalls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-0910?

CVE-2022-0910 is a medium-severity authentication bypass vulnerability in Zyxel ATP series firmware, published on 24 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Weakness: CWE-287

Which versions are affected by CVE-2022-0910?

It affects 32 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 26 more.

How do I fix CVE-2022-0910?

No fix has been published for CVE-2022-0910 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-0910 being exploited?

There is no known exploitation of CVE-2022-0910 in the wild and no public exploit code.

Sources

Also known as GHSA-mv2h-6cx9-44g2.