CVE-2022-0342: Zyxel firewall CGI authentication bypass grants admin access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and an EPSS score near the top percentile, make this a high-risk internet-facing authentication bypass.

What it is

The CGI program in multiple Zyxel firewall firmware lines (USG/ZyWALL, USG FLEX, ATP, VPN, NSG) fails to properly enforce authentication, allowing a remote attacker to bypass web authentication. Because these devices are internet-facing security gateways, a bypass yields full administrative control of the appliance.

Impact

An attacker gains administrative access to the device, enabling configuration changes, policy manipulation, and potential use of the firewall as a pivot into protected networks.

Attack surface

Reachable over the network via the device's web management interface (CVSS vector AV:N/PR:N/UI:N), requiring no authentication and no user interaction.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high (0.94858, 99.856th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor firmware update from the Zyxel security advisory for all affected USG/ZyWALL, USG FLEX, ATP, VPN, and NSG models.
• Restrict web management access to trusted management networks or VPN only; do not expose the admin interface to the internet.
• Disable remote/WAN management where not strictly required and enforce strong admin credentials and MFA if supported.
• Audit device configurations and logs for unauthorized admin changes after patching, and rotate admin credentials.
• Monitor vendor advisories for updated firmware, as the listed version ranges may be superseded.

Detection

• Review firewall/device logs for successful admin logins or configuration changes from unexpected source IPs.
• Alert on access to CGI management endpoints from external or non-management networks.
• Baseline and monitor admin account, policy, and firmware changes for anomalies.
• Hunt for new or modified local admin accounts and unexpected VPN or firewall rule additions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.