CVE-2022-30525criticalunder attackCWE-78

CVE-2022-30525: critical vulnerability in Zyxel USG FLEX 100(W) firmware

Published · Updated

Follow this CVE+ Monitor ATP series+ Monitor VPN series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDMay 12
1st PoCMay 10
metasploitApr 28
CISA KEV+4d
Action required by CISAfederal deadline: 2022-06-06

Apply updates per vendor instructions.

In short

A vulnerability in Zyxel firewall and VPN devices allows attackers to run harmful system commands by manipulating certain files. This is critical because it gives attackers complete control over the device.

Technical detail

OS command injection in CGI program affects multiple Zyxel USG and ATP device models (firmware 5.00–5.21 Patch 1, with VPN series from 4.60). Attack vector involves modifying specific files to inject OS commands; requires network access to CGI interface. Impact: arbitrary command execution with device privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Zyxel · ATP series firmwareZyxel · USG 20(W)-VPN firmwareZyxel · USG FLEX 100(W) firmwareZyxel · USG FLEX 200 firmwareZyxel · USG FLEX 500 firmwareZyxel · USG FLEX 50(W) firmwareZyxel · USG FLEX 700 firmwareZyxel · VPN series firmware
public PoCs found — 29
exploitdbwww.exploit-db.com/exploits/50946unverifiedgithubgithub.com/shuai06/CVE-2022-30525★ 33githubgithub.com/jbaines-r7/victorian_machinery★ 30githubgithub.com/Henry4E36/CVE-2022-30525★ 22githubgithub.com/west9b/CVE-2022-30525★ 12githubgithub.com/savior-only/CVE-2022-30525★ 4githubgithub.com/iveresk/cve-2022-30525★ 3githubgithub.com/Chocapikk/CVE-2022-30525-Reverse-Shell★ 3githubgithub.com/k0sf/CVE-2022-30525★ 3githubgithub.com/cbk914/CVE-2022-30525_check★ 2githubgithub.com/superzerosec/CVE-2022-30525★ 1githubgithub.com/furkanzengin/CVE-2022-30525★ 1githubgithub.com/arajsingh-infosec/CVE-2022-30525_Exploit★ 1githubgithub.com/M4fiaB0y/CVE-2022-30525★ 1githubgithub.com/ProngedFork/CVE-2022-30525★ 1githubgithub.com/160Team/CVE-2022-30525★ 0vulncheckvulncheck.com/xdb/6355edd8b2d3unverifiedvulncheckvulncheck.com/xdb/84daae28d6b7unverifiedcve_referencepacketstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.htmlunverifiedvulncheckvulncheck.com/xdb/1962bae6dcc9unverifiedvulncheckvulncheck.com/xdb/c4e27dfd021cunverifiedcve_referencepacketstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.htmlunverifiedvulncheckvulncheck.com/xdb/8715c26267faunverifiedvulncheckvulncheck.com/xdb/e15afba00994unverifiedvulncheckvulncheck.com/xdb/bb42ffd583c7unverifiedvulncheckvulncheck.com/xdb/fae80e0c7f01unverifiedvulncheckvulncheck.com/xdb/f52f29d8e852unverifiedcve_referencepacketstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Zyxel USG FLEX 100(W) firmware

In the same product, most dangerous first.

CVE-2023-28771CRITICALCVE-2023-28771EPSS 99.3%KEVCVE-2023-33010CRITICALCVE-2023-33010EPSS 29.0%KEVCVE-2023-33009CRITICALCVE-2023-33009EPSS 28.1%KEVCVE-2024-11667HIGHCVE-2024-11667EPSS 3.0%KEVCVE-2022-0342CRITICALCVE-2022-0342EPSS 95.1%CVE-2023-33012HIGHCVE-2023-33012EPSS 9.9%