{"containers": {"cna": {"affected": [{"product": "USG FLEX 100(W) firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"product": "USG FLEX 200 firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"product": "USG FLEX 500 firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"product": "USG FLEX 700 firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"product": "ATP series firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}, {"product": "VPN series firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "4.60 through 5.21 Patch 1"}]}, {"product": "USG FLEX 50(W) firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}, {"product": "USG 20(W)-VPN firmware", "vendor": "Zyxel", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}], "descriptions": [{"lang": "en", "value": "A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-31T18:06:16.000Z", "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "shortName": "Zyxel"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@zyxel.com.tw", "ID": "CVE-2022-30525", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "USG FLEX 100(W) firmware", "version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}}, {"product_name": "USG FLEX 200 firmware", "version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}}, {"product_name": "USG FLEX 500 firmware", "version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}}, {"product_name": "USG FLEX 700 firmware", "version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}}, {"product_name": "ATP series firmware", "version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}}, {"product_name": "VPN series firmware", "version": {"version_data": [{"version_value": "4.60 through 5.21 Patch 1"}]}}, {"product_name": "USG FLEX 50(W) firmware", "version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}}, {"product_name": "USG 20(W)-VPN firmware", "version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}}]}, "vendor_name": "Zyxel"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device."}]}, "impact": {"cvss": {"baseScore": "9.8", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}]}, "references": {"reference_data": [{"name": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml", "refsource": "CONFIRM", "url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml"}, {"name": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html"}, {"name": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html"}, {"name": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html"}, {"name": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:48:36.383Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-30525", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-29T16:09:58.800835Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-05-16", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525", "tags": ["government-resource"]}], "timeline": [{"time": "2022-05-16T00:00:00+00:00", "lang": "en", "value": "CVE-2022-30525 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T23:15:39.737Z"}}]}, "cveMetadata": {"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "assignerShortName": "Zyxel", "cveId": "CVE-2022-30525", "datePublished": "2022-05-12T13:05:11.000Z", "dateReserved": "2022-05-10T00:00:00.000Z", "dateUpdated": "2025-10-21T23:15:39.737Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:48:36.383Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-30525", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-29T16:09:58.800835Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-05-16", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525"}}}], "timeline": [{"lang": "en", "time": "2022-05-16T00:00:00+00:00", "value": "CVE-2022-30525 added to CISA KEV"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-29T16:10:05.061Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Zyxel", "product": "USG FLEX 100(W) firmware", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "USG FLEX 200 firmware", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "USG FLEX 500 firmware", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "USG FLEX 700 firmware", "versions": [{"status": "affected", "version": "5.00 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "ATP series firmware", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "VPN series firmware", "versions": [{"status": "affected", "version": "4.60 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "USG FLEX 50(W) firmware", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}, {"vendor": "Zyxel", "product": "USG 20(W)-VPN firmware", "versions": [{"status": "affected", "version": "5.10 through 5.21 Patch 1"}]}], "references": [{"url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "shortName": "Zyxel", "dateUpdated": "2022-08-31T18:06:16.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"version": "3.1", "baseScore": "9.8", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}, "product_name": "USG FLEX 100(W) firmware"}, {"version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}, "product_name": "USG FLEX 200 firmware"}, {"version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}, "product_name": "USG FLEX 500 firmware"}, {"version": {"version_data": [{"version_value": "5.00 through 5.21 Patch 1"}]}, "product_name": "USG FLEX 700 firmware"}, {"version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}, "product_name": "ATP series firmware"}, {"version": {"version_data": [{"version_value": "4.60 through 5.21 Patch 1"}]}, "product_name": "VPN series firmware"}, {"version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}, "product_name": "USG FLEX 50(W) firmware"}, {"version": {"version_data": [{"version_value": "5.10 through 5.21 Patch 1"}]}, "product_name": "USG 20(W)-VPN firmware"}]}, "vendor_name": "Zyxel"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml", "name": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml", "refsource": "CONFIRM"}, {"url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html", "name": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html", "name": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html", "name": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", "name": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-30525", "STATE": "PUBLIC", "ASSIGNER": "security@zyxel.com.tw"}}}}, "cveMetadata": {"cveId": "CVE-2022-30525", "state": "PUBLISHED", "dateUpdated": "2025-10-21T18:46:43.618Z", "dateReserved": "2022-05-10T00:00:00.000Z", "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f", "datePublished": "2022-05-12T13:05:11.000Z", "assignerShortName": "Zyxel"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-06-06", "cisaExploitAdd": "2022-05-16", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Zyxel Multiple Firewalls OS Command Injection Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C07FAFDD-18ED-4BDE-9D35-BFF93C2FF276", "versionEndExcluding": "5.30", "versionStartIncluding": "5.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*", "matchCriteriaId": "D74ABA7E-AA78-4A13-A64E-C44021591B42", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD4726D4-52AF-4584-AB05-2BF4767E5BC1", "versionEndExcluding": "5.30", "versionStartIncluding": "5.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*", "matchCriteriaId": "F93B6A06-2951-46D2-A7E1-103D7318D612", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "37470C96-3006-4265-A5B6-054D44055060", "versionEndIncluding": "5.30", "versionStartIncluding": "5.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "92C697A5-D1D3-4FF0-9C43-D27B18181958", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AF2483B-9C56-4A69-B374-8C88D2705E65", "versionEndExcluding": "5.30", "versionStartIncluding": "5.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*", "matchCriteriaId": "9D1396E3-731B-4D05-A3F8-F3ABB80D5C29", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D2BC1AF-C8A7-4D60-870C-D5C6EF289ADA", "versionEndExcluding": "5.30", "versionStartIncluding": "4.60", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*", "matchCriteriaId": "81D90A7B-174F-40A1-8AF4-08B15B7BAC40", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB23E9D6-3515-46D5-A2C4-76D6E003ECFC", "versionEndExcluding": "5.30", "versionStartIncluding": "4.60", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "EECD311A-4E96-4576-AADF-47291EDE3559", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "434CE377-1F94-4AC1-AB14-0ED4A659D37D", "versionEndExcluding": "5.30", "versionStartIncluding": "4.60", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C45C303-1A95-4245-B242-3AB9B9106CD4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E4038EB-C5E0-409F-AD88-4C2E6EDA3A3F", "versionEndExcluding": "5.30", "versionStartIncluding": "4.60", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*", "matchCriteriaId": "9E3AC823-0ECA-42D8-8312-2FBE5914E4C0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "73E839CA-AB89-4A58-9614-F7E7905BDBBC", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*", "matchCriteriaId": "7F7654A1-3806-41C7-82D4-46B0CD7EE53B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C5E9252-2297-4371-9A3C-DC94402B5EB8", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*", "matchCriteriaId": "47398FD0-6C5E-4625-9EFD-DE08C9AB7DB2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C866B1BE-19EC-43AE-BBA4-3844A0A4FEB2", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D68A36FF-8CAF-401C-9F18-94F3A2405CF4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3518DDB4-C6B2-4047-8D07-67A5CFA09DD6", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*", "matchCriteriaId": "2818E8AC-FFEE-4DF9-BF3F-C75166C0E851", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA0953D6-AC1A-4C2C-90E8-217590852ACD", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*", "matchCriteriaId": "0B41F437-855B-4490-8011-DF59887BE6D5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD8831D8-D40C-4A85-9F74-58067A241F73", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*", "matchCriteriaId": "66B99746-0589-46E6-9CBD-F38619AD97DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8D00C93-69CF-4FA9-9A67-B053FECBBAC7", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*", "matchCriteriaId": "110A1CA4-0170-4834-8281-0A3E14FC5584", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C639F04A-8810-4445-BE88-2E6FF1D9C3C5", "versionEndExcluding": "5.30", "versionStartIncluding": "5.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*", "matchCriteriaId": "06D2AD3A-9197-487D-A267-24DE332CC66B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del Sistema Operativo en el programa CGI del firmware Zyxel USG FLEX 100(W) versiones 5.00 hasta 5.21 Parche 1, firmware USG FLEX 200 versiones 5.00 hasta 5.21 Parche 1, firmware USG FLEX 500 versiones 5.00 hasta 5.21 Parche 1, firmware USG FLEX 700 versiones 5.00 hasta 5.21 Parche 1, firmware USG FLEX 50(W) versiones 5. 10 hasta 5.21 Parche 1, firmware USG20(W)-VPN versiones 5.10 hasta 5.21 Parche 1, firmware de la serie ATP versiones 5.10 hasta 5.21 Parche 1, firmware de la serie VPN versiones 4.60 hasta 5.21 Parche 1, lo que podr\u00eda permitir a un atacante modificar archivos espec\u00edficos y luego ejecutar algunos comandos del Sistema Operativo en un dispositivo vulnerable"}], "id": "CVE-2022-30525", "lastModified": "2025-10-21T20:19:08.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@zyxel.com.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-12T14:15:07.053", "references": [{"source": "security@zyxel.com.tw", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html"}, {"source": "security@zyxel.com.tw", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html"}, {"source": "security@zyxel.com.tw", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html"}, {"source": "security@zyxel.com.tw", "tags": ["Exploit", "Third Party Advisory"], "url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html"}, {"source": "security@zyxel.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml"}], "sourceIdentifier": "security@zyxel.com.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security@zyxel.com.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}