CVE-2024-42061

MEDIUM

6.1

CVSS Score

Published: September 3, 2024 at 01:59 AM UTC

Updated: June 17, 2026 at 07:48 AM UTC

20 products affected across 1 vendorZldUsg Flex 200Usg Flex 500

Using ATP series firmware by Zyxel?

Get instant alerts when new vulnerabilities affect ATP series firmware - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Zld · Zyxel

95%

4.16 ≤ v < 5.394.32 ≤ v < 5.394.50 ≤ v < 5.39

Affected range stops below 5.39, so it looks safe — our inference, not a vendor statement

zyxel-atp100 (environment) · zyxel-atp100w (environment) · zyxel-atp200 (environment) · zyxel-atp500 (environment) · zyxel-atp700 (environment) · zyxel-atp800 (environment) · zyxel-usg-20w-vpn (environment) · zyxel-usg-flex-100 (environment) · zyxel-usg-flex-100ax (environment) · zyxel-usg-flex-100w (environment) · zyxel-usg-flex-200 (environment) · zyxel-usg-flex-50 (environment) · zyxel-usg-flex-500 (environment) · zyxel-usg-flex-50w (environment) · zyxel-usg-flex-700 (environment)

ATP · Zyxel

60%

v ≤ 5.38

USG FLEX · Zyxel

60%

v ≤ 5.38

Usg Flex 50 · Zyxel

60%

v ≤ 5.38

Usg Flex 50W · Zyxel

60%

v ≤ 5.38