CVE-2019-9955

Published: Apr 22, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.

Affected (21)

Products: Zyxel: Atp200 Firmware, Atp500 Firmware, Atp800 Firmware, Usg20 Vpn Firmware, Usg20w Vpn Firmware, Usg40 Firmware, Usg40w Firmware, Usg60 Firmware, Usg60w Firmware, Usg110 Firmware, Usg210 Firmware, Usg310 Firmware, Usg1100 Firmware, Usg1900 Firmware, Usg2200 Vpn Firmware, Zywall 110 Firmware, Zywall 310 Firmware, Zywall 1100 Firmware, Vpn50 Firmware, Vpn100 Firmware, Vpn300 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp200 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Atp200	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp500 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Atp500	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp800 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Atp800	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20 Vpn Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg20 Vpn	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20w Vpn Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg20w Vpn	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg40 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg40	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg40w Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg40w	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg60 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg60	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg60w Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg60w	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg110 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg110	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg210 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg210	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg310 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg310	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg1100 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg1100	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg1900 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg1900	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg2200 Vpn Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Usg2200 Vpn	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 110 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Zywall 110	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 310 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Zywall 310	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Zywall 1100 Firmware	Version 4.31

Running on/with	Platform Versions
Zyxel Zywall 1100	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn50 Firmware	All versions

Running on/with	Platform Versions
Zyxel Vpn50	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn100 Firmware	All versions

Running on/with	Platform Versions
Zyxel Vpn100	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn300 Firmware	All versions

Running on/with	Platform Versions
Zyxel Vpn300	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2019/Apr/22

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.exploit-db.com/exploits/46706/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page

Source: cve@mitre.org

PatchThird Party Advisory

https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml

Source: cve@mitre.org

Vendor Advisory

http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html