description: The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: ATP series firmware
vendor: Zyxel
versions:
status: affected, version: 4.32 through 5.35
}
{
defaultStatus: unaffected
product: USG FLEX series firmware
vendor: Zyxel
versions:
status: affected, version: 4.50 through 5.35
}
{
defaultStatus: unaffected
product: USG FLEX 50(W) firmware
vendor: Zyxel
versions:
status: affected, version: 4.16 through 5.35
}
{
defaultStatus: unaffected
product: USG20(W)-VPN firmware
vendor: Zyxel
versions:
status: affected, version: 4.16 through 5.35
}
{
defaultStatus: unaffected
product: VPN series firmware
vendor: Zyxel
versions:
status: affected, version: 4.30 through 5.35
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL