CVE-2008-2167 — Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page

Back Back to CVE browser

MEDIUM

Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page

Published May 13, 2008

4.3

MEDIUM

CVSS 2.0

EPSS 16.78%

Description

Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page.

Affected products

Remediation

No remediation recorded yet.

Metrics

16.78% 0.16784

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.16784

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	16.78% (0.16784)	96.95th	v5 (v2026.06.15)
Jun 15, 2026	16.78% (0.16784)	96.63th	v5 (v2026.06.15)
Mar 24, 2026	4.29% (0.04294)	88.76th	v4 (v2025.03.14)
Mar 30, 2025	5.95% (0.05950)	89.70th	v4 (v2025.03.14)
Mar 29, 2025	4.49% (0.04490)	81.48th	v4 (v2025.03.14)
Mar 22, 2025	5.95% (0.05950)	89.81th	v4 (v2025.03.14)
Mar 17, 2025	10.31% (0.10313)	92.61th	v4 (v2025.03.14)
Feb 7, 2025	46.52% (0.46518)	97.57th	v3 (v2023.03.01)
Dec 17, 2024	43.39% (0.43394)	97.41th	v3 (v2023.03.01)
Oct 15, 2024	84.02% (0.84022)	98.54th	v3 (v2023.03.01)
Mar 9, 2024	87.59% (0.87586)	98.55th	v3 (v2023.03.01)
Nov 22, 2023	89.72% (0.89724)	98.47th	v3 (v2023.03.01)
Mar 7, 2023	91.24% (0.91237)	98.26th	v3 (v2023.03.01)
Mar 6, 2023	3.13% (0.03129)	83.91th	v2 (v2022.01.01)
Apr 1, 2022	3.13% (0.03129)	82.33th	v2 (v2022.01.01)
Feb 4, 2022	3.13% (0.03129)	65.00th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (8)

http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062152.html
mailing-listx_refsource_FULLDISCExploit
http://secunia.com/advisories/30142
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/3869
third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/491818/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/29110
vdb-entryx_refsource_BIDExploit
http://www.securitytracker.com/id?1020000
vdb-entryx_refsource_SECTRACK
http://www.vupen.com/english/advisories/2008/1501/references
vdb-entryx_refsource_VUPEN
https://exchange.xforce.ibmcloud.com/vulnerabilities/42282
vdb-entryx_refsource_XF

Link	Providers	Tags
http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062152.html		mailing-listx_refsource_FULLDISCExploit
http://secunia.com/advisories/30142		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/3869		third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/491818/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/29110		vdb-entryx_refsource_BIDExploit
http://www.securitytracker.com/id?1020000		vdb-entryx_refsource_SECTRACK
http://www.vupen.com/english/advisories/2008/1501/references		vdb-entryx_refsource_VUPEN
https://exchange.xforce.ibmcloud.com/vulnerabilities/42282		vdb-entryx_refsource_XF