CVE-2022-0910

MEDIUM Year: 2022
CVSS v3 Score
6.5
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-287
View all →

Vulnerability Description

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.

Related Vulnerabilities

CVE-2009-1596

MEDIUM
CVSS:6.5(Medium)

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intende...

CWE-2872009

CVE-2012-1258

MEDIUM
CVSS:6.5(Medium)

cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with adminis...

CWE-2872012

CVE-2015-4987

MEDIUM
CVSS:6.5(Medium)

The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM X-Force ID: 105896.

CWE-2872015

CVE-2015-5298

MEDIUM
CVSS:6.5(Medium)

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps d...

CWE-2872015

CVE-2016-10832

MEDIUM
CVSS:6.5(Medium)

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).

CWE-2872016

CVE-2016-10836

MEDIUM
CVSS:6.5(Medium)

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).

CWE-2872016