Vulnerability Description
A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | Zld | >= 4.32, < 5.39 |
| Zyxel | Atp100 | - |
| Zyxel | Atp100W | - |
| Zyxel | Atp200 | - |
| Zyxel | Atp500 | - |
| Zyxel | Atp700 | - |
| Zyxel | Atp800 | - |
| Zyxel | Usg Flex 100 | - |
| Zyxel | Usg Flex 100Ax | - |
| Zyxel | Usg Flex 100W | - |
| Zyxel | Usg Flex 200 | - |
| Zyxel | Usg Flex 50 | - |
| Zyxel | Usg Flex 500 | - |
| Zyxel | Usg Flex 700 | - |
| Zyxel | Usg Flex 50W | - |
| Zyxel | Usg 20W-Vpn | - |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2024-42061?
CVE-2024-42061 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.5...
How severe is CVE-2024-42061?
CVE-2024-42061 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-42061?
Check the references section above for vendor advisories and patch information. Affected products include: Zyxel Zld, Zyxel Atp100, Zyxel Atp100W, Zyxel Atp200, Zyxel Atp500.