What’s Vulnerable › Vulnerabilities

CVE-2021-46387

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-01 · updated 2026-06-17
• Weakness: CWE-79

Description

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.

Affected products

• Zyxel Zywall 2 Plus Internet Security Appliance Firmware: all versions

References

• http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
• https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing
• https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml
• https://www.zyxel.com/us/en/support/security_advisories.shtml
• http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
• https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing
• https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtml
• https://www.zyxel.com/us/en/support/security_advisories.shtml

Get alerted when CVE-2021-46387 or the next vulnerability affects your stack