CVE-2022-30526 Privilege escalation in ATP series firmware

High 7.8 Published 19 Jul 2022 Updated 3 Aug 2024

A local attacker can execute OS commands with root privileges via a CLI command vulnerability in Zyxel USG and ATP series firmware.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-30526?

CVE-2022-30526 is a high-severity vulnerability in Zyxel ATP series firmware, published on 19 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

Weakness: CWE-269

Which versions are affected by CVE-2022-30526?

It affects 25 products.

Products include Zyxel Atp100 Firmware, Zyxel Atp100w Firmware, Zyxel Atp200 Firmware, Zyxel Atp500 Firmware, Zyxel Atp700 Firmware, Zyxel Atp800 Firmware and 19 more.

How do I fix CVE-2022-30526?

No fix has been published for CVE-2022-30526 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-30526 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30526 exists.

Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-8f7x-36qv-2prx.