Back to Database
Status published
Medium
CVE-2019-9955
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60,...
Vulnerability Description
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9955
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page
- http://seclists.org/fulldisclosure/2019/Apr/22
- https://www.exploit-db.com/exploits/46706/
- http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html
- https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtml
More from zyxel
View All →CVE-2021-46387
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by...
Medium
6.1
CVE-2021-3297
On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to...
High
7.8
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented...
Unknown
0
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via...
High
7.2
CVE-2020-28899
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does...
Critical
9.1
Affected Vendor
zyxel
View all reports →Affected Software
atp200 firmware, atp500 firmware, atp800 firmware, usg20-vpn firmware, usg20w-vpn firmware, usg40 firmware, usg40w firmware, usg60 firmware, usg60w firmware, usg110 firmware, usg210 firmware, usg310 firmware, usg1100 firmware, usg1900 firmware, usg2200-vpn firmware, zywall 110 firmware, zywall 310 firmware, zywall 1100 firmware, vpn50 firmware, vpn100 firmware, vpn300 firmware
Vulnerable Versions:
4.31
Timeline
Official Publish:
April 22nd, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.