CVE-2022-30525
Zyxel Multiple Firewalls OS Command Injection Vulnerability
Description
CVE-2022-30525 is a command injection vulnerability in the CGI program of certain Zyxel firewall versions that allows an unauthenticated attacker to modify specific files and execute operating system commands on the vulnerable device. This vulnerability affects multiple Zyxel firewall models and enables remote code execution through the firewall's web management interface. CISA has confirmed active exploitation and included CVE-2022-30525 in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 99.99%, this is one of the most actively exploited network device vulnerabilities, posing a critical threat to organizations using affected Zyxel firewalls as their network perimeter security.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zyxel | usg flex 100w firmware | >= 5.00, < 5.30 |
| zyxel | usg flex 200 firmware | >= 5.00, < 5.30 |
| zyxel | usg flex 500 firmware | >= 5.00, <= 5.30 |
| zyxel | usg flex 700 firmware | >= 5.00, < 5.30 |
| zyxel | vpn100 firmware | >= 4.60, < 5.30 |
| zyxel | vpn1000 firmware | >= 4.60, < 5.30 |
| zyxel | vpn300 firmware | >= 4.60, < 5.30 |
| zyxel | vpn50 firmware | >= 4.60, < 5.30 |
| zyxel | atp100 firmware | >= 5.10, < 5.30 |
| zyxel | atp100w firmware | >= 5.10, < 5.30 |
| zyxel | atp200 firmware | >= 5.10, < 5.30 |
| zyxel | atp500 firmware | >= 5.10, < 5.30 |
| zyxel | atp700 firmware | >= 5.10, < 5.30 |
| zyxel | atp800 firmware | >= 5.10, < 5.30 |
| zyxel | usg flex 50w firmware | >= 5.10, < 5.30 |
| zyxel | usg20w-vpn firmware | >= 5.10, < 5.30 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html(Exploit, Third Party Advisory)
- https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-78 describes a weakness where a product constructs OS commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2022-30525, the Zyxel firewall's CGI program fails to sanitize user input before passing it to system shell commands, allowing an attacker to inject arbitrary OS commands that execute with the privileges of the web server process on the firewall.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Impact Analysis
CVE-2022-30525 is a command injection vulnerability in Zyxel firewalls that allows unauthenticated remote code execution through the device's web management interface. The vulnerability is remotely exploitable from the network without any authentication, making it trivially accessible to any attacker who can reach the firewall's management interface. Successful exploitation grants the attacker the ability to execute arbitrary operating system commands on the firewall, which in most deployments operates as the network perimeter security device. This means an attacker who compromises the firewall can intercept and modify all network traffic passing through it, disable security rules, create VPN tunnels for persistent access, pivot into the internal network, and exfiltrate data. The EPSS percentile of 99.99% — among the highest possible — confirms that this vulnerability is virtually certain to be exploited and represents one of the most critical network security threats. The compromise of a firewall is particularly devastating because it subverts the primary security boundary that organizations rely upon to protect their internal networks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-30525 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 6, 2022. The EPSS percentile of 99.99% places this vulnerability at the absolute top of exploitation likelihood, confirming massive real-world exploitation. Public exploit code became available rapidly after disclosure, and mass scanning and exploitation campaigns were observed targeting internet-facing Zyxel firewalls worldwide. Multiple security firms documented active exploitation by both opportunistic attackers and advanced threat groups. The straightforward nature of the command injection — requiring only a single HTTP request to the management interface — makes exploitation trivially simple, and the widespread internet exposure of Zyxel firewall management interfaces ensures a large attack surface.
Remediation
- Update all affected Zyxel firewalls to the firmware versions that contain the fix for CVE-2022-30525 as specified in Zyxel's security advisory. CISA mandates remediation by June 6, 2022.
- Immediately restrict access to the firewall's web management interface to trusted administrative IP addresses only. Never expose the management interface to the public internet.
- If firmware updates cannot be applied immediately, disable the web management interface entirely and use alternative management methods (SSH, console) until the update can be installed.
- Review firewall logs for signs of exploitation, including unexpected command execution, unauthorized configuration changes, creation of new user accounts, or unusual outbound connections from the firewall.
- If exploitation is suspected, treat the firewall as fully compromised — reset it to factory defaults, apply the patched firmware, restore configuration from a known-good backup, and rotate all credentials that may have been accessible through the firewall including VPN pre-shared keys and administrative passwords.
Technical Details
CVE-2022-30525 is an OS command injection vulnerability in the CGI program of multiple Zyxel firewall models. The vulnerability exists because user-supplied input received through HTTP requests to the firewall's web management interface is passed directly to operating system shell commands without proper sanitization or escaping of special characters. Specifically, the CGI handler constructs system commands by concatenating user input into shell command strings, which are then executed via system() or similar shell invocation functions. An attacker can inject shell metacharacters (such as semicolons, pipes, or backticks) into the input parameters to append arbitrary OS commands that execute with the privileges of the web server process — which on Zyxel firewalls typically runs as root. The attack requires only a single crafted HTTP request to the management interface, making it extremely simple to exploit. The affected firewall models include ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series devices, which are widely deployed in small-to-medium business and enterprise network perimeters.
Frequently Asked Questions
Is CVE-2022-30525 being actively exploited?
Yes, CVE-2022-30525 is being massively exploited. CISA has included it in the KEV catalog with an urgent remediation deadline, and its EPSS percentile of 99.99% places it among the most exploited vulnerabilities in existence. Mass scanning campaigns targeting internet-facing Zyxel firewalls have been widely documented.
What products are affected by CVE-2022-30525?
CVE-2022-30525 affects multiple Zyxel firewall models including ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN series devices. Consult Zyxel's security advisory for the specific firmware versions that are vulnerable and the corresponding patched versions.
How do I fix CVE-2022-30525?
Update all affected Zyxel firewalls to the patched firmware versions. Immediately restrict management interface access to trusted IPs only. Review logs for signs of prior exploitation and rotate all credentials if compromise is suspected.
How severe is CVE-2022-30525?
CVE-2022-30525 is a critical command injection vulnerability with an EPSS percentile of 99.99%. It allows unauthenticated remote code execution on network firewalls, which represent the primary security boundary for most organizations. Compromise of a firewall enables complete network infiltration.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.