{"answers":{"affected":"It affects 16 products.","exploited":"Yes. Attackers have exploited CVE-2022-30525 in the wild since at least 16 May 2022.","fix":"No fix has been published for CVE-2022-30525 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Jun 2022.","what":"CVE-2022-30525 is a critical command injection vulnerability in Zyxel ATP series firmware, published on 12 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-30525 and fix it if it is affected.\n\nWhat it is: CVE-2022-30525 is a critical command injection vulnerability in Zyxel ATP series firmware, published on 12 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2022-30525 in the wild since at least 16 May 2022.\n\nAffected product: Zyxel ATP series firmware. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-30525/ (Markdown: https://insights.sbomify.com/CVE-2022-30525/index.md)","id":"CVE-2022-30525","markdown":"https://insights.sbomify.com/CVE-2022-30525/index.md","name":"CVE-2022-30525","record":{"aliases":["GHSA-987m-9prq-3p7m"],"analysis":{"component_type":"network_device","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Zyxel USG/ATP/VPN firmware","requires_auth":"none","summary":"Attackers can execute OS commands on Zyxel USG, ATP, and VPN devices by modifying specific files in the CGI program.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Zyxel","cpe":[{"product":"atp100_firmware","vendor":"zyxel"},{"product":"atp100w_firmware","vendor":"zyxel"},{"product":"atp200_firmware","vendor":"zyxel"},{"product":"atp500_firmware","vendor":"zyxel"},{"product":"atp700_firmware","vendor":"zyxel"},{"product":"atp800_firmware","vendor":"zyxel"},{"product":"usg20w-vpn_firmware","vendor":"zyxel"},{"product":"usg_flex_100w_firmware","vendor":"zyxel"},{"product":"usg_flex_200_firmware","vendor":"zyxel"},{"product":"usg_flex_500_firmware","vendor":"zyxel"},{"product":"usg_flex_50w_firmware","vendor":"zyxel"},{"product":"usg_flex_700_firmware","vendor":"zyxel"},{"product":"vpn1000_firmware","vendor":"zyxel"},{"product":"vpn100_firmware","vendor":"zyxel"},{"product":"vpn300_firmware","vendor":"zyxel"},{"product":"vpn50_firmware","vendor":"zyxel"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.","ecosystems":[],"exploits":{"exploitdb":1,"first_seen":"2022-04-28","github_poc":14,"max_poc_stars":33,"metasploit":1,"nuclei":1,"refs":[{"date":"2022-05-13T12:58:43Z","kind":"github_poc","ref":"https://github.com/shuai06/CVE-2022-30525","stars":33,"title":"Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）批量检测脚本"},{"date":"2022-05-10T10:31:19Z","kind":"github_poc","ref":"https://github.com/jbaines-r7/victorian_machinery","stars":30,"title":"Proof of concept exploit for CVE-2022-30525 (Zxyel firewall command injection)"},{"date":"2022-05-13T12:03:28Z","kind":"github_poc","ref":"https://github.com/Henry4E36/CVE-2022-30525","stars":22,"title":"Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）"},{"date":"2022-05-28T07:19:31Z","kind":"github_poc","ref":"https://github.com/west9b/CVE-2022-30525","stars":12,"title":"CVE-2022-30525 Zyxel 防火墙命令注入漏洞 POC\u0026EXPC "},{"date":"2022-05-13T18:16:31Z","kind":"github_poc","ref":"https://github.com/savior-only/CVE-2022-30525","stars":4,"title":"Zyxel 防火墙未经身份验证的远程命令注入"},{"date":"2022-05-16T04:45:43Z","kind":"github_poc","ref":"https://github.com/k0sf/CVE-2022-30525","stars":3,"title":"CVE-2022-30525（Zxyel 防火墙命令注入）的概念证明漏洞利用"},{"date":"2022-05-18T15:22:17Z","kind":"github_poc","ref":"https://github.com/Chocapikk/CVE-2022-30525-Reverse-Shell","stars":3,"title":"Simple python script to exploit CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection"},{"date":"2022-05-23T16:51:42Z","kind":"github_poc","ref":"https://github.com/iveresk/cve-2022-30525","stars":3,"title":"Initial POC for the CVE-2022-30525"}],"tier":"exploited"},"has_fix":null,"headline":"Zyxel Multiple Firewalls OS Command Injection","id":"CVE-2022-30525","indexable":true,"kev":{"dateAdded":"2022-05-16","dueDate":"2022-06-06","knownRansomwareCampaignUse":"Unknown","product":"Multiple Firewalls","requiredAction":"Apply updates per vendor instructions.","vendorProject":"Zyxel","vulnerabilityName":"Zyxel Multiple Firewalls OS Command Injection Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"command_injection","year":"2022"},"n_packages":0,"n_references":5,"next":{"headline":"Privilege escalation in ATP series firmware","id":"CVE-2022-30526"},"packages":[],"prev":{"headline":"Memory corruption in n/a","id":"CVE-2022-30524"},"products":["ATP series firmware","USG 20(W)-VPN firmware","USG FLEX 100(W) firmware","USG FLEX 200 firmware","USG FLEX 50(W) firmware","USG FLEX 500 firmware","USG FLEX 700 firmware","VPN series firmware"],"published":"2022-05-12","related":[{"cvss_score":9.8,"headline":"Zyxel Multiple Firewalls Buffer Overflow","id":"CVE-2023-33009","kev_date_added":"2023-06-05","published":"2023-05-24"},{"cvss_score":9.8,"headline":"Zyxel Multiple Firewalls Buffer Overflow","id":"CVE-2023-33010","kev_date_added":"2023-06-05","published":"2023-05-24"},{"cvss_score":9.8,"headline":"Zyxel Multiple Firewalls OS Command Injection","id":"CVE-2023-28771","kev_date_added":"2023-05-31","published":"2023-04-25"},{"cvss_score":9.8,"headline":"Zyxel Multiple Products Use of Hard-Coded Credentials","id":"CVE-2020-29583","kev_date_added":"2021-11-03","published":"2020-12-22"},{"cvss_score":9.8,"headline":"Zyxel Multiple NAS Devices OS Command Injection","id":"CVE-2020-9054","kev_date_added":"2022-03-25","published":"2020-03-04"},{"cvss_score":9.8,"headline":"Auth bypass in ATP series firmware","id":"CVE-2022-0342","kev_date_added":null,"published":"2022-03-28"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-21","vendors":["Zyxel"]},"summary":"Attackers can execute OS commands on Zyxel USG, ATP, and VPN devices by modifying specific files in the CGI program.","url":"https://insights.sbomify.com/CVE-2022-30525/"}