CVE-2022-0910
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI...
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
- Record
CVE-2022-0910- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2022-15940
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
- Record
EUVD-2022-15940- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mv2h-6cx9-44g2
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI...
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
- Record
GHSA-mv2h-6cx9-44g2- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
- Record
CVE-2022-0910- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- zyxel atp series firmware
- zyxel usg flex series firmware
- zyxel usg/zywall series firmware
- zyxel vpn series firmware
- zyxel atp100 firmware
- zyxel atp100w firmware
- zyxel atp200 firmware
- zyxel atp500 firmware
- zyxel atp700 firmware
- zyxel atp800 firmware
- zyxel usg200 firmware
- zyxel usg20 firmware
Show 24 moreShow less
- zyxel usg210 firmware
- zyxel usg2200 firmware
- zyxel usg300 firmware
- zyxel usg310 firmware
- zyxel usg 1100 firmware
- zyxel usg 110 firmware
- zyxel usg 1900 firmware
- zyxel usg 20w-vpn firmware
- zyxel usg 20w firmware
- zyxel usg 2200-vpn firmware
- zyxel usg 310 firmware
- zyxel usg 40 firmware
- zyxel usg 40w firmware
- zyxel usg 60 firmware
- zyxel usg 60w firmware
- zyxel usg flex 100 firmware
- zyxel usg flex 100w firmware
- zyxel usg flex 200 firmware
- zyxel usg flex 500 firmware
- zyxel usg flex 700 firmware
- zyxel vpn1000 firmware
- zyxel vpn100 firmware
- zyxel vpn300 firmware
- zyxel vpn50 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0910 is a medium vulnerability (CVSS 6.5) in Zyxel Atp Series Firmware, published May 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. No source names a fixed version.