CVE-2022-0342: Zyxel ATP100 Firmware

Critical severity, CVSS 9.8. EPSS: 95.1% chance of exploitation in the next 30 days.

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.

Affected products

• Zyxel ATP100 Firmware: from 4.32, up to and including 5.20
• Zyxel ATP100W Firmware: from 4.32, up to and including 5.20
• Zyxel ATP200 Firmware: from 4.32, up to and including 5.20
• Zyxel ATP500 Firmware: from 4.32, up to and including 5.20
• Zyxel ATP700 Firmware: from 4.32, up to and including 5.20
• Zyxel ATP800 Firmware: from 4.32, up to and including 5.20
• Zyxel NSG300 Firmware: from 1.20, before 1.33 (fixed in 1.33); version 1.33 only
• Zyxel USG40 Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel USG40W Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel USG60 Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel USG60W Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel Usg Flex 100 Firmware: from 4.50, up to and including 5.20
• Zyxel Usg Flex 100w Firmware: from 4.50, up to and including 5.20
• Zyxel Usg Flex 200 Firmware: from 4.50, up to and including 5.20
• Zyxel Usg Flex 500 Firmware: from 4.50, up to and including 5.20
• Zyxel Usg Flex 700 Firmware: from 4.50, up to and including 5.20
• Zyxel VPN1000 Firmware: from 4.30, before 5.21 (fixed in 5.21)
• Zyxel VPN100 Firmware: from 4.30, before 5.21 (fixed in 5.21)
• Zyxel VPN300 Firmware: from 4.30, before 5.21 (fixed in 5.21)
• Zyxel VPN50 Firmware: from 4.30, before 5.21 (fixed in 5.21)
• Zyxel Zywall 1100 Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel Zywall 110 Firmware: from 4.20, before 4.71 (fixed in 4.71)
• Zyxel Zywall 310 Firmware: from 4.20, before 4.71 (fixed in 4.71)

Published 2022-03-28. Last modified 2026-06-17.