Actively exploited · Published May 12, 2022 · Assigned by Zyxel
CVE-2022-30525
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in ATP series firmware from Zyxel. Attackers are actively exploiting it in the wild (listed by CISA on May 16, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 6, 2022.
Official description
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | USG FLEX 100(W) firmware | 5.00 through 5.21 Patch 1 |
| Zyxel | USG FLEX 200 firmware | 5.00 through 5.21 Patch 1 |
| Zyxel | USG FLEX 500 firmware | 5.00 through 5.21 Patch 1 |
| Zyxel | USG FLEX 700 firmware | 5.00 through 5.21 Patch 1 |
| Zyxel | ATP series firmware | 5.10 through 5.21 Patch 1 |
| Zyxel | VPN series firmware | 4.60 through 5.21 Patch 1 |
| Zyxel | USG FLEX 50(W) firmware | 5.10 through 5.21 Patch 1 |
| Zyxel | USG 20(W)-VPN firmware | 5.10 through 5.21 Patch 1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml x_refsource_CONFIRM
- http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html x_refsource_MISC
- http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525 government-resource