CVEvulnerability
CVE-2021-46387
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-03-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.
Affected configurations
• zyxel zywall 2 plus internet security appliance firmware
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
- https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing Exploit, Third Party Advisory
- https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml Broken Link, Vendor Advisory
- https://www.zyxel.com/us/en/support/security_advisories.shtml Vendor Advisory
- http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
- https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing Exploit, Third Party Advisory
- https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml Broken Link, Vendor Advisory
- https://www.zyxel.com/us/en/support/security_advisories.shtml Vendor Advisory