CVE-2022-26532: high-severity vulnerability in Zyxel USG/ZyWALL series firmware
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 4.8%
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · ATP series firmwareZyxel · NAP203 firmwareZyxel · NSG series firmwareZyxel · NWA50AX firmwareZyxel · NXC2500 firmwareZyxel · USG FLEX series firmwareZyxel · USG/ZyWALL series firmwareZyxel · VPN series firmwareZyxel · WAC500 firmwareZyxel · WAX510D firmwareRelated CVEs — Zyxel USG/ZyWALL series firmware
In the same product, most dangerous first.