Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW…
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter.
Why it matters now
EPSS 0.01638 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:zyxel:p-660hw:_t1:-:*:*:*:*:*:* | _t1 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw:_t1:v2:*:*:*:*:*:* | _t1 v2 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw_d1:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw_d1:v2:*:*:*:*:*:*:* | v2 | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw_d3:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw_t3:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:p-660hw_t3:v2:*:*:*:*:*:*:* | v2 | Vulnerable | Zyxel |
- cpe:2.3:h:zyxel:p-660hw:_t1:-:*:*:*:*:*:* Versions _t1 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw:_t1:v2:*:*:*:*:*:* Versions _t1 v2 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw_d1:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw_d1:v2:*:*:*:*:*:*:* Versions v2 Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw_d3:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw_t3:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:p-660hw_t3:v2:*:*:*:*:*:*:* Versions v2 Vulnerable ·Zyxel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-1257
- 2026-10-03 Alias added: GHSA-6r4w-76v2-6gp5
References
More Zyxel P-660hw vulnerabilities
- TI-2008-01207 The ZyXEL P-660HW series router has "admin" as its default password, which allows remote… CVSS 2.0HIGH 10.0
- TI-2008-01206 The ZyXEL P-660HW series router maintains authentication state by IP address, which… CVSS 2.0HIGH 10.0
- TI-2013-03134 The web management interface on Zyxel P660 devices allows remote attackers to cause a… CVSS 2.0HIGH 7.8
- TI-2014-03401 Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3)… CVSS 2.0MEDIUM 6.8
- TI-2008-01205 Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2008-1257 · CVE Program
- CVE-2008-1257 · NVD
- FIRST EPSS
- GHSA-6r4w-76v2-6gp5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences