CVE-2022-30525 Zyxel Multiple Firewalls OS Command Injection
Attackers can execute OS commands on Zyxel USG, ATP, and VPN devices by modifying specific files in the CGI program.
- Exploited in the wild
- Since 16 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30525?
CVE-2022-30525 is a critical command injection vulnerability in Zyxel ATP series firmware, published on 12 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Weakness: CWE-78
Which versions are affected by CVE-2022-30525?
It affects 16 products.
Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 10 more.
How do I fix CVE-2022-30525?
No fix has been published for CVE-2022-30525 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Jun 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-30525 being exploited?
Yes. Attackers have exploited CVE-2022-30525 in the wild since at least 16 May 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 14 proofs of concept on GitHub.
Other vulnerabilities in Zyxel ATP series firmware
- CVE-2023-33009 Zyxel Multiple Firewalls Buffer Overflow
- CVE-2023-33010 Zyxel Multiple Firewalls Buffer Overflow
- CVE-2023-28771 Zyxel Multiple Firewalls OS Command Injection
- CVE-2020-29583 Zyxel Multiple Products Use of Hard-Coded Credentials
- CVE-2020-9054 Zyxel Multiple NAS Devices OS Command Injection
Sources
Also known as GHSA-987m-9prq-3p7m.