CVE-2022-0342
CRITICALCVE-2022-0342 is a critical-severity (CVSS 9.8) Improper Authentication vulnerability. EPSS puts its 30-day exploitation probability at 95.1% (100th percentile). No vendor fix is recorded yet; mitigation options are listed below.
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series…
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2022-0342 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
Affected Products
atp100 firmwarezyxelatp100w firmwarezyxelatp200 firmwarezyxelatp500 firmwarezyxelatp700 firmwarezyxelatp800 firmwarezyxelDetection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2022-0342 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
How to detect CVE-2022-0342
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2022-0342 -u https://target- Template
- Zyxel - Authentication Bypass
- Severity
- critical
- Impact
- Unauthenticated attackers can bypass web authentication and obtain administrative access to Zyxel devices, potentially gaining complete control over firewalls and network security configurations.
- Remediation
- Apply security updates provided by Zyxel for affected USG/ZyWALL, USG FLEX, ATP, VPN, and NSG series devices.
Template by ProjectDiscovery nuclei-templates (SleepingBag945, Powerexploit), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2022-0342 in your dependencies?
Find it across , including transitive dependencies.