CVE-2022-40603 Cross-site scripting in ATP series firmware

Medium 4.7 Published 6 Dec 2022 Updated 23 Apr 2025

Attackers can execute malicious scripts in victims' browsers via crafted URLs, potentially stealing browser-based information from Zyxel firewall users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-40603?

CVE-2022-40603 is a medium-severity cross-site scripting vulnerability in Zyxel ATP series firmware, published on 6 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser.

Weakness: CWE-79

Which versions are affected by CVE-2022-40603?

It affects 19 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 13 more.

How do I fix CVE-2022-40603?

No fix has been published for CVE-2022-40603 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-40603 being exploited?

There is no known exploitation of CVE-2022-40603 in the wild and no public exploit code.

Sources

Also known as GHSA-6jf5-53hp-585m.