CVE-2024-42061 Overview
CVE-2024-42061 is a reflected cross-site scripting (XSS) vulnerability in the dynamic_script.cgi CGI program shipped with Zyxel firewall firmware. The flaw affects the ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series across multiple firmware releases. An attacker who convinces an authenticated user to click a crafted URL can execute arbitrary JavaScript in the victim's browser context. Successful exploitation can expose browser-based information tied to the firewall management interface. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Reflected XSS in the firewall management interface enables session context abuse and disclosure of browser-accessible data when an administrator visits an attacker-supplied URL.
Affected Products
- Zyxel ATP series firmware versions V4.32 through V5.38 (ATP100, ATP100W, ATP200, ATP500, ATP700, ATP800)
- Zyxel USG FLEX series firmware versions V4.50 through V5.38 (USG FLEX 100, 100AX, 100W, 200, 500, 700)
- Zyxel USG FLEX 50(W) firmware versions V4.16 through V5.38 and USG20(W)-VPN firmware versions V4.16 through V5.38
Discovery Timeline
- 2024-09-03 - Zyxel publishes the security advisory for multiple firewall vulnerabilities
- 2024-09-03 - CVE-2024-42061 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-42061
Vulnerability Analysis
The vulnerability resides in the dynamic_script.cgi component of the Zyxel ZLD firmware web management interface. The CGI program reflects one or more request parameters into an HTTP response without properly encoding or sanitizing user-supplied input. When a target user loads a crafted URL, the browser parses the injected payload as executable script. Because the payload runs in the origin of the firewall management portal, the attacker can read data accessible to the victim's browser session, including tokens, cookies not marked HttpOnly, and rendered page content. Exploitation requires user interaction, which limits mass exploitation but aligns well with targeted phishing against network administrators.
Root Cause
The root cause is missing output encoding in dynamic_script.cgi. Input received through request parameters flows into the generated HTML or JavaScript response without contextual escaping, which is the canonical pattern for CWE-79 reflected XSS.
Attack Vector
Exploitation is network-based and requires the victim to click a link or load attacker-controlled content that issues a request to the vulnerable CGI endpoint. The payload executes in the victim's browser under the firewall management origin. No exploit code or CISA KEV listing is publicly associated with this CVE at the time of publication. Refer to the Zyxel advisory for vendor-provided technical context.
Detection Methods for CVE-2024-42061
Indicators of Compromise
- HTTP requests to dynamic_script.cgi containing URL-encoded HTML or JavaScript tokens such as %3Cscript, onerror=, or javascript:.
- Referer headers on management-plane requests originating from external domains or webmail hosts.
- Unexpected outbound requests from administrator browsers immediately after loading a firewall management URL.
Detection Strategies
- Inspect web proxy and firewall logs for GET or POST requests to /dynamic_script.cgi with parameter values containing script-related keywords.
- Correlate management interface access with the source IP and user-agent of administrator workstations to identify anomalous request patterns.
- Deploy a Web Application Firewall (WAF) signature or intrusion detection signature targeting reflected XSS payload structures in requests to Zyxel management endpoints.
Monitoring Recommendations
- Restrict and log all access to the firewall web administration interface, and alert on requests sourced from untrusted networks.
- Monitor phishing telemetry and email gateways for URLs referencing internal Zyxel management hostnames or IP addresses.
- Track firmware versions across managed Zyxel devices to identify hosts still running affected V4.x or V5.x builds up to V5.38.
How to Mitigate CVE-2024-42061
Immediate Actions Required
- Upgrade all affected Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN devices to firmware versions released after V5.38 per the vendor advisory.
- Restrict web management access to trusted management networks and disable WAN-side administration where possible.
- Instruct firewall administrators to avoid clicking untrusted links while authenticated to the device management interface.
Patch Information
Zyxel released patched firmware alongside the Zyxel Security Advisory for Firewalls (September 3, 2024). Administrators should consult the advisory for the exact fixed firmware build for each affected model and apply updates through the standard Zyxel firmware upgrade process.
Workarounds
- Limit administrative access to the firewall to specific source IP ranges using the built-in access control policy.
- Use dedicated administrator browsers or browser profiles that do not have access to arbitrary internet browsing while managing the device.
- Enforce short administrative session timeouts to reduce the window in which a reflected XSS payload can act on an active session.
# Example: restrict HTTPS management access to a trusted subnet on Zyxel ZLD CLI
configure terminal
service-control HTTPS access-group MGMT_TRUSTED
object-group address MGMT_TRUSTED
address 10.10.0.0 255.255.255.0
exit
write
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
