CVE-2022-0910
CVE-2022-0910
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
24 may 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Zyxel · ATP series firmwareZyxel · USG FLEX series firmwareZyxel · USG/ZyWALL series firmwareZyxel · VPN series firmware¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →