CVE-2019-9955

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.

• CWE-79

• http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/22Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/46706/Exploit, Third Party Advisory, VDB Entry
• https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-pagePatch, Third Party Advisory
• https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtmlVendor Advisory
• http://packetstormsecurity.com/files/152525/Zyxel-ZyWall-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/22Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/46706/Exploit, Third Party Advisory, VDB Entry
• https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-pagePatch, Third Party Advisory
• https://www.zyxel.com/support/reflected-cross-site-scripting-vulnerability-of-firewalls.shtmlVendor Advisory

Published

Apr 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9946Cloud Native Computing Foundation (CNCF) CNI (Container Netw…
• CVE-2019-9947An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-9948urllib in Python 2.x through 2.7.16 supports the local_file:…9.1
• CVE-2019-9949Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX21…
• CVE-2019-9950Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2…
• CVE-2019-9951Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2…
• CVE-2019-9956In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer o…
• CVE-2019-9957Stored XSS within Quadbase EspressReport ES (ERES) v7.0 upda…
• CVE-2019-9958CSRF within the admin panel in Quadbase EspressReport ES (ER…
• CVE-2019-9959The JPXStream::init function in Poppler 0.78.0 and earlier d…6.5
• CVE-2019-9960The downloadZip function in application/controllers/admin/ex…
• CVE-2019-9961A cross-site scripting (XSS) vulnerability in ressource view…