A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 up to and including 5.37, USG FLEX series firmware versions 5.00 up to and including 5.37, USG FLEX 50(W) series firmware versions 5.10 up to and including 5.37, USG20(W)-VPN series firmware versions 5.10 up to and including 5.37, and VPN series firmware versions 5.00 up to and including 5.37, could allow an unauthenticated LAN-based malicious user to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed to steal cookies when the user visits the specific CGI used for dumping ZTP logs.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
zyxel zld |
Vulmon