PT-2022-2515 · Zyxel · Zyxel Usg Flex 50+7

Published 2022-05-12 · Updated 2025-03-13 · CVE-2022-30525

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX 100(W) versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 200 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 500 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 700 versions 5.00 through 5.21 Patch 1 Zyxel USG FLEX 50(W) versions 5.10 through 5.21 Patch 1 Zyxel USG20(W)-VPN versions 5.10 through 5.21 Patch 1 Zyxel ATP series versions 5.10 through 5.21 Patch 1 Zyxel VPN series versions 4.60 through 5.21 Patch 1

Description A OS command injection vulnerability in the CGI program of Zyxel firewalls could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. The vulnerability is related to errors in processing input data in the HTTP administration interface. An attacker can exploit this vulnerability by sending a specially crafted file to the device. According to the Shodan service, there are 16213 potentially vulnerable devices on the global network that accept HTTP/HTTPS requests. The vulnerability has been exploited in real-world incidents, including attempts to spread the Mirai malware. The Chaos malware, a multifunctional malware written in Go, has also been observed exploiting this vulnerability to increase its botnet network.

Recommendations For Zyxel USG FLEX 100(W) versions 5.00 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel USG FLEX 200 versions 5.00 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel USG FLEX 500 versions 5.00 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel USG FLEX 700 versions 5.00 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel USG FLEX 50(W) versions 5.10 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel USG20(W)-VPN versions 5.10 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel ATP series versions 5.10 through 5.21 Patch 1, update to firmware version 5.30 or later. For Zyxel VPN series versions 4.60 through 5.21 Patch 1, update to firmware version 5.30 or later. As a temporary workaround, consider disabling the /ztp/cgi-bin/handler API endpoint until a patch is available. Restrict access to the vulnerable CGI program to minimize the risk of exploitation. Avoid using the handler CGI program in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-02929

CVE-2022-30525

Affected Products

Zyxel Atp Series

Zyxel Usg Flex 100

Zyxel Usg Flex 200

Zyxel Usg Flex 50

Zyxel Usg Flex 500

Zyxel Usg Flex 700

Zyxel Usg20(W)-Vpn

Zyxel Vpn Series

References · 61

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zyxel_ztp_rce.rb · Exploit
• 🔥 https://github.com/jbaines-r7/victorian_machinery · Exploit
• 🔥 https://github.com/shuai06/CVE-2022-30525 · Exploit
• 🔥 https://github.com/Henry4E36/CVE-2022-30525 · Exploit
• 🔥 https://github.com/west9b/CVE-2022-30525 · Exploit
• 🔥 https://github.com/savior-only/CVE-2022-30525 · Exploit
• 🔥 https://github.com/iveresk/cve-2022-30525 · Exploit
• 🔥 https://github.com/YGoldking/CVE-2022-30525 · Exploit
• 🔥 https://github.com/k0sf/CVE-2022-30525 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-30525-Reverse-Shell · Exploit
• 🔥 https://exploit-db.com/exploits/50946 · Exploit
• 🔥 http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html · Exploit
• 🔥❌ https://github.com/ExploitPwner/CVE-2022-30525-Zyxel-Mass-Exploiter · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html · Exploit
• 🔥 https://0day.today/exploit/37766 · Exploit