CVE-2022-0910

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
May 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-09115.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-09124.8Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-09137.5Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.CVE-2022-09146.5The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a loggeCVE-2022-09157.0There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitCVE-2022-09168.8An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable tCVE-2022-09187.5A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cCVE-2022-09195.3The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any CVE-2022-09207.5The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could CVE-2022-09216.7Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09226.5The software does not perform any authentication for critical system functionality.CVE-2022-09239.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ash