CVE-2022-0342

What it actually does

CVE-2022-0342 is an unauthenticated, network-reachable authentication bypass in the CGI component of multiple Zyxel firewall, VPN, and security gateway firmware lines. On affected versions, a remote attacker can bypass the web management authentication flow and obtain administrative access to the device without valid credentials. Successful exploitation can provide full confidentiality, integrity, and availability impact: attackers may view or export configuration, alter firewall/VPN policies, create accounts, change routing or DNS settings, disable security controls, pivot into internal networks, or disrupt device operation.

Why it matters to the business

Affected Zyxel security gateways often sit at the network perimeter and enforce VPN, firewall, and segmentation controls. Compromise can therefore expose internal networks, remote-access infrastructure, and sensitive configuration such as VPN settings or credentials. Because the vulnerability is remotely exploitable without credentials, has a critical CVSS score, a high EPSS likelihood score, and is assessed as weaponized, internet-exposed management interfaces should be treated as high-priority remediation targets even though the issue is not currently listed in CISA KEV and is not specifically tagged as ransomware-used.

How an attack unfolds

An attacker first identifies an internet-accessible Zyxel USG, ZyWALL, USG FLEX, ATP, VPN, or NSG device with the web management interface reachable. They fingerprint the device and firmware family, then send crafted requests to the vulnerable CGI authentication flow that cause the device to treat the session as authenticated. Once administrative access is obtained, the attacker can interact with the management interface or APIs as an administrator. Typical post-exploitation actions include creating a persistent admin account, exporting device configuration, changing firewall or NAT rules, modifying VPN settings, disabling logging or security services, uploading or changing firmware/configuration, and using the device as a foothold for internal reconnaissance or traffic interception.

How to fix it

Upgrade affected Zyxel firmware to a vendor-fixed release outside the vulnerable ranges. The affected ranges include USG/ZyWALL firmware 4.20 through 4.70, USG FLEX firmware 4.50 through 5.20, ATP firmware 4.32 through 5.20, VPN firmware 4.30 through 5.20, and NSG firmware V1.20 through V1.33 Patch 4. If an immediate upgrade is not possible, restrict web management access to trusted administrative networks only, disable WAN-side management, require VPN or jump-host access for administration, enforce strong administrator credentials and MFA where supported, remove unused admin accounts, and monitor for unexpected configuration changes. After patching, rotate administrator credentials, VPN/shared secrets, API keys, and any credentials stored in or retrievable from the device configuration if compromise is suspected.

How to confirm the fix worked

Confirm the exact model and firmware version from the Zyxel management interface or CLI and verify it is newer than the affected firmware range for that product line. Validate that the web management interface is not reachable from untrusted networks unless explicitly required and protected by compensating controls. Perform an external exposure check from the internet to confirm administrative services are not publicly accessible. Review the vendor firmware release notes or security advisory to confirm the installed version contains the fix for this authentication bypass. After remediation, attempt only authorized, non-destructive validation that unauthenticated requests cannot access administrative pages or APIs, and confirm that all administrative access requires successful authentication.

Typical attack path

1. Scan the internet or target address ranges for exposed Zyxel web management interfaces.
2. Fingerprint the device model and firmware family to determine whether it falls within an affected version range.
3. Send crafted unauthenticated requests to the vulnerable CGI authentication component to bypass login.
4. Establish an administrative session without valid credentials.
5. Create or modify administrator accounts, API access, VPN users, or configuration settings for persistence.
6. Export configuration data and review firewall, VPN, routing, DNS, and credential-related settings.
7. Use the compromised perimeter device to alter traffic flows, weaken access controls, pivot toward internal systems, or disrupt network availability.

How to detect it

Review Zyxel device logs, remote syslog, SIEM records, firewall logs, VPN logs, and configuration backups for signs of unauthorized administrative access or configuration tampering. Focus on the period before patching and any time the management interface was reachable from untrusted networks. Look for successful administrator sessions without corresponding legitimate user activity, logins from unfamiliar external IP addresses, unexpected creation or modification of admin accounts, unexplained password changes, configuration exports/downloads, changes to firewall/NAT/VPN/DNS/routing rules, disabled logging or security services, firmware upload or reboot events, and management access occurring outside normal maintenance windows. Compare current configuration against known-good backups to identify unauthorized changes. If logs are sparse, correlate upstream firewall or reverse-proxy records for HTTP/HTTPS requests to the Zyxel management interface, particularly requests to CGI endpoints followed by administrative actions.

What your security team should do

• Immediately inventory Zyxel USG, ZyWALL, USG FLEX, ATP, VPN, and NSG appliances, including model, firmware version, and whether management interfaces are internet-accessible.
• Prioritize patching or isolating any device running firmware in the affected ranges, especially perimeter devices with WAN-side management enabled.
• Disable public web management access and restrict administration to trusted networks, VPN, or dedicated management segments.
• Review administrator accounts, recent configuration changes, VPN users, firewall/NAT rules, DNS settings, and logging settings for unauthorized modifications.
• Rotate administrator passwords and sensitive device secrets after patching if there is any indication the device was exposed or accessed unexpectedly.
• Export and preserve relevant logs before rebooting or upgrading devices where compromise is suspected, because appliance logs may be limited or overwritten.
• Add monitoring for unusual administrative logins, configuration exports, new account creation, firmware changes, and management access from unfamiliar source IP addresses.