CVE-2021-35030

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-26 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.

Affected products

Zyxel GS1900-10HP firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-16 firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-24 firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-24E firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-24EP firmware: before 2.70 — fixed in 2.70
Zyxel Gs1900-24Hp Firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-24HPv2 firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-48 firmware: before 2.70 — fixed in 2.70
Zyxel Gs1900-48Hp Firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-48HPv2 firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-8 firmware: before 2.70 — fixed in 2.70
Zyxel GS1900-8HP firmware: before 2.70 — fixed in 2.70

How to fix

Upgrade to a fixed version: Zyxel GS1900-10HP firmware 2.70; Zyxel GS1900-16 firmware 2.70; Zyxel GS1900-24 firmware 2.70; Zyxel GS1900-24E firmware 2.70; Zyxel GS1900-24EP firmware 2.70; Zyxel Gs1900-24Hp Firmware 2.70; Zyxel GS1900-24HPv2 firmware 2.70; Zyxel GS1900-48 firmware 2.70; Zyxel Gs1900-48Hp Firmware 2.70; Zyxel GS1900-48HPv2 firmware 2.70; Zyxel GS1900-8 firmware 2.70; Zyxel GS1900-8HP firmware 2.70. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-35030 or the next vulnerability affects your stack