CVE-2022-26532 Command injection in ATP series firmware
A local authenticated attacker can execute arbitrary OS commands via argument injection in the packet-trace CLI command on Zyxel network devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26532?
CVE-2022-26532 is a high-severity command injection vulnerability in Zyxel ATP series firmware, published on 24 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.
Which versions are affected by CVE-2022-26532?
It affects 65 products.
Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 59 more.
How do I fix CVE-2022-26532?
No fix has been published for CVE-2022-26532 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-26532 being exploited?
There is no known exploitation of CVE-2022-26532 in the wild and no public exploit code.
Other vulnerabilities in Zyxel ATP series firmware
- CVE-2023-33009 Zyxel Multiple Firewalls Buffer Overflow
- CVE-2023-33010 Zyxel Multiple Firewalls Buffer Overflow
- CVE-2023-28771 Zyxel Multiple Firewalls OS Command Injection
- CVE-2022-30525 Zyxel Multiple Firewalls OS Command Injection
- CVE-2020-29583 Zyxel Multiple Products Use of Hard-Coded Credentials
Sources
Also known as GHSA-gfh5-53xq-j227.