CVE-2022-0342

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03437.8A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) ma CVE-2022-03444.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.CVE-2022-03454.3The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users CVE-2022-03466.1The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu CVE-2022-03476.1The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i CVE-2022-03485.4Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.CVE-2022-03499.8The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading CVE-2022-03505.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.CVE-2022-03517.8Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.CVE-2022-03526.1Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.CVE-2022-03534.4A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versi CVE-2022-03547.8A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute cod