CRLF injection in ZyXEL Communications Corp. products - #VU64055
Published: June 8, 2022
Vulnerability identifier: #VU64055
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in the CGI program. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
Affected software
USG100
USG200
USG300
USG20W
USG20
USG50
USG200
USG300
USG20W
USG20
USG50
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.