CVE-2019-9955

Name of the Vulnerable Software and Affected Versions Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 (affected versions not specified)

Description The issue is related to the lack of protection of the web page structure in Zyxel firewalls, allowing a remote attacker to perform a cross-site scripting attack using the mp idx parameter. This can lead to Reflected XSS on the Zyxel login page.

Recommendations For Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, consider disabling access to the vulnerable login page until a patch is available. As a temporary workaround, avoid using the mp idx parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.