中危 Zyxel USG/ZyWALL 授权问题漏洞（CVE-2022-0342）
CVE编号
CVE-2022-0342利用情况
暂无补丁情况
官方补丁披露时间
2022-03-28漏洞描述
Zyxel USG/ZyWALL是中国合勤科技（Zyxel）公司的一款防火墙。 Zyxel USG/ZyWALL 4.20版本至4.70版本、USG FLEX 4.50版本至5.20版本、ATP 4.32版本至5.20版本、VPN 4.30版本至5.20版本、NSG 1.20版本至1.33 Patch 4版本存在安全漏洞，攻击者利用该漏洞绕过Web身份验证并获得设备的管理访问权限。解决建议
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
参考链接 |
|
|---|---|
| https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypa... |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp100w_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp100_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp200_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp500_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp700_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | atp800_firmware | * | From (including) 4.32 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | nsg300_firmware | * | From (including) 1.20 | Up to (excluding) 1.33 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | nsg300_firmware | 1.33 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg40w_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg40_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg60w_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg60_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg_flex_100w_firmware | * | From (including) 4.50 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg_flex_100_firmware | * | From (including) 4.50 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg_flex_200_firmware | * | From (including) 4.50 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg_flex_500_firmware | * | From (including) 4.50 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | usg_flex_700_firmware | * | From (including) 4.50 | Up to (including) 5.20 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | vpn1000_firmware | * | From (including) 4.30 | Up to (excluding) 5.21 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | vpn100_firmware | * | From (including) 4.30 | Up to (excluding) 5.21 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | vpn300_firmware | * | From (including) 4.30 | Up to (excluding) 5.21 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | vpn50_firmware | * | From (including) 4.30 | Up to (excluding) 5.21 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | zywall_1100_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | zywall_110_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 系统 | zyxel | zywall_310_firmware | * | From (including) 4.20 | Up to (excluding) 4.71 | ||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp100 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp100w | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp200 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp500 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp700 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | atp800 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | nsg300 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg40 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg40w | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg60 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg60w | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg_flex_100 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg_flex_100w | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg_flex_200 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg_flex_500 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | usg_flex_700 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | vpn100 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | vpn1000 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | vpn300 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | vpn50 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | zywall_110 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | zywall_1100 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | zyxel | zywall_310 | - | - | |||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 N/A
| CWE-ID | 漏洞类型 |
| CWE-287 | 认证机制不恰当 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论