Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-30525
HistoryMay 12, 2022 - 2:15 p.m.

CVE-2022-30525

2022-05-1214:15:07
CWE-78
[email protected]
web.nvd.nist.gov
1

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

JSON

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Affected configurations

NVD
Node
zyxelusg_flex_100w_firmwareRange5.00–5.30
AND
zyxelusg_flex_100wMatch-
Node
zyxelusg_flex_200_firmwareRange5.00–5.30
AND
zyxelusg_flex_200Match-
Node
zyxelusg_flex_500_firmwareRange5.00–5.30
AND
zyxelusg_flex_500Match-
Node
zyxelusg_flex_700_firmwareRange5.00–5.30
AND
zyxelusg_flex_700Match-
Node
zyxelvpn100_firmwareRange4.60–5.30
AND
zyxelvpn100Match-
Node
zyxelvpn1000_firmwareRange4.60–5.30
AND
zyxelvpn1000Match-
Node
zyxelvpn300_firmwareRange4.60–5.30
AND
zyxelvpn300Match-
Node
zyxelvpn50_firmwareRange4.60–5.30
AND
zyxelvpn50Match-
Node
zyxelatp100_firmwareRange5.10–5.30
AND
zyxelatp100Match-
Node
zyxelatp100w_firmwareRange5.10–5.30
AND
zyxelatp100wMatch-
Node
zyxelatp200_firmwareRange5.10–5.30
AND
zyxelatp200Match-
Node
zyxelatp500_firmwareRange5.10–5.30
AND
zyxelatp500Match-
Node
zyxelatp700_firmwareRange5.10–5.30
AND
zyxelatp700Match-
Node
zyxelatp800_firmwareRange5.10–5.30
AND
zyxelatp800Match-
Node
zyxelusg_flex_50w_firmwareRange5.10–5.30
AND
zyxelusg_flex_50wMatch-
Node
zyxelusg20w-vpn_firmwareRange5.10–5.30
AND
zyxelusg20w-vpnMatch-

Related

checkpoint_advisories 1
metasploit 2
prion 1
githubexploit 13
nuclei 1
nessus 1
attackerkb 1
packetstorm 3
rapid7blog 6
cisa_kev 1
zdt 3
cvelist 1
cve 1
exploitdb 1
thn 5
malwarebytes 1
mssecure 1
mmpc 1
checkpoint_advisories
checkpoint_advisories
Zyxel USG Command Injection (CVE-2022-30525)
2022-05-19 00:00:00
metasploit
metasploit
Zyxel Firewall ZTP Unauthenticated Command Injection
2022-05-12 08:43:59
Zyxel Firewall SUID Binary Privilege Escalation
2022-07-19 10:29:11
prion
prion
Command injection
2022-05-12 14:15:00
githubexploit
githubexploit
Exploit for OS Command Injection in Zyxel Usg Flex 100W Firmware
2022-05-13 12:58:43
Exploit for OS Command Injection in Zyxel Usg Flex 100W Firmware
2023-01-15 20:02:24
Exploit for OS Command Injection in Zyxel Usg Flex 100W Firmware
2022-05-16 04:45:43
nuclei
nuclei
Zyxel Firewall - OS Command Injection
2022-05-13 02:52:42
nessus
nessus
Zyxel Command Injection (CVE-2022-30525) (Direct Check)
2023-01-11 00:00:00
attackerkb
attackerkb
CVE-2022-30525
2022-05-12 00:00:00
packetstorm
packetstorm
Zyxel USG FLEX 5.21 Command Injection
2022-06-03 00:00:00
Zyxel Firewall ZTP Unauthenticated Command Injection
2022-05-16 00:00:00
Zyxel Firewall SUID Binary Privilege Escalation
2022-08-31 00:00:00
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2022-05-20 19:14:42
CVE-2022-30526 (Fixed): Zyxel Firewall Local Privilege Escalation
2022-07-19 12:56:06
CVE-2022-32230: Windows SMB Denial-of-Service Vulnerability (FIXED)
2022-06-14 17:10:06
cisa_kev
cisa_kev
Zyxel Multiple Firewalls OS Command Injection Vulnerability
2022-05-16 00:00:00
zdt
zdt
Zyxel USG FLEX 5.21 - OS Command Injection Exploit
2022-06-03 00:00:00
Zyxel Firewall ZTP Unauthenticated Command Injection Exploit
2022-05-16 00:00:00
Zyxel Firewall SUID Binary Privilege Escalation Exploit
2022-09-02 00:00:00
cvelist
cvelist
CVE-2022-30525
2022-05-12 13:05:11
cve
cve
CVE-2022-30525
2022-05-12 14:15:07
exploitdb
exploitdb
Zyxel USG FLEX 5.21 - OS Command Injection
2022-06-03 00:00:00
thn
thn
Researchers Warn of New Go-based Malware Targeting Windows and Linux Systems
2022-09-28 14:00:00
Watch Out! Hackers Begin Exploiting Recent Zyxel Firewalls RCE Vulnerability
2022-05-17 03:17:00
Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability
2022-05-13 06:24:00
malwarebytes
malwarebytes
Zyxel patches two critical vulnerabilities
2023-05-26 15:00:00
mssecure
mssecure
Microsoft research uncovers new Zerobot capabilities
2022-12-21 20:00:00
mmpc
mmpc
Microsoft research uncovers new Zerobot capabilities
2022-12-21 20:00:00

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.975 High

EPSS

Percentile

100.0%

JSON
Related for NVD:CVE-2022-30525
checkpoint_advisories1metasploit2prion1githubexploit13nuclei1nessus1attackerkb1packetstorm3rapid7blog6cisa_kev1zdt3cvelist1cve1exploitdb1thn5malwarebytes1mssecure1mmpc1