CVE-2019-9955

MEDIUM NUCLEI

Zyxel Firewall Devices - Reflected Cross-Site Scripting via Login Page mp_idx Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-9955. PoCs published by Aaron Bishop. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Zyxel devices via the mp_idx parameter in weblogin.cgi and webauth_relogin.cgi. The PoC injects a malicious JavaScript payload to steal login credentials by leveraging jQuery's getScript functionality.

Description

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.

Exploits (1)

exploitdb WORKING POC
by Aaron Bishop · textwebappshardware
https://www.exploit-db.com/exploits/46706

This exploit demonstrates a reflected XSS vulnerability in Zyxel devices via the mp_idx parameter in weblogin.cgi and webauth_relogin.cgi. The PoC injects a malicious JavaScript payload to steal login credentials by leveraging jQuery's getScript functionality.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Zyxel ZyWall 310, ZyWall 110, USG1900, ATP500, USG40 (V4.31)
No auth needed
Prerequisites: Access to the login page of the vulnerable Zyxel device · Ability to host a malicious JavaScript file on an attacker-controlled server
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Zyxel - Cross-Site Scripting
MEDIUMby pdteam

References (5)

Core 5
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Apr/22
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/46706/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.html

Scores

CVSS v3 6.1
EPSS 0.2095
EPSS Percentile 97.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (21)
zyxel/atp200_firmware 4.31
zyxel/atp500_firmware 4.31
zyxel/atp800_firmware 4.31
zyxel/usg1100_firmware 4.31
zyxel/usg110_firmware 4.31
zyxel/usg1900_firmware 4.31
zyxel/usg20-vpn_firmware 4.31
zyxel/usg20w-vpn_firmware 4.31
zyxel/usg210_firmware 4.31
zyxel/usg2200-vpn_firmware 4.31
... and 11 more
Published Apr 22, 2019
Tracked Since Feb 18, 2026