CVE-2022-0910

Published May 24, 2022 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-15940 A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
History

No history.

Subscriptions

Weaknesses

Sources

Status
PUBLISHED
Assigner
Zyxel
Published
Updated
Aug 2, 2024, 11:47 PM
Reserved
Mar 10, 2022, 12:00 AM
Status
Modified
Published
May 24, 2022, 3:15 AM
Modified
Jun 17, 2026, 4:21 AM