CVE-2021-46387: zyxel zywall_2_plus_internet_security_appliance_firmware Cross-site Scripting
Vulnerability summary
CVE-2021-46387 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in zyxel zywall_2_plus_internet_security_appliance_firmware. EPSS estimates a 20.95% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 01-03-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
20.95%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 20.95% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (drive.google.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Zyxel1 product
1 vendor · 1 product
References
4 links- drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharingX Refsource MISCExploitThird Party Advisory
- packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry