CVE-2024-42061 Details
Description
A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 3, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zyxel zld | >= 4.32, < 5.39 >= 4.50, < 5.39 >= 4.16, < 5.39 |
CPE
Remediation
| |
| zyxel atp100 | All versions |
CPE
Remediation
| |
| zyxel atp100w | All versions |
CPE
Remediation
| |
| zyxel atp200 | All versions |
CPE
Remediation
| |
| zyxel atp500 | All versions |
CPE
Remediation
| |
| zyxel atp700 | All versions |
CPE
Remediation
| |
| zyxel atp800 | All versions |
CPE
Remediation
| |
| zyxel usg flex 100 | All versions |
CPE
Remediation
| |
| zyxel usg flex 100ax | All versions |
CPE
Remediation
| |
| zyxel usg flex 100w | All versions |
CPE
Remediation
| |
| zyxel usg flex 200 | All versions |
CPE
Remediation
| |
| zyxel usg flex 50 | All versions |
CPE
Remediation
| |
| zyxel usg flex 500 | All versions |
CPE
Remediation
| |
| zyxel usg flex 700 | All versions |
CPE
Remediation
| |
| zyxel usg flex 50w | All versions |
CPE
Remediation
| |
| zyxel usg 20w-vpn | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 13, 2024 | Reanalysis | [email protected] |
| Sep 5, 2024 | Initial Analysis | [email protected] |
| Sep 3, 2024 | New CVE Received | [email protected] |