Read the docs
TI-2022-12682 Aliases CVE-2022-30525GHSA-987m-9prq-3p7m

OS command injection in Zyxel USG FLEX 100 firmware

Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Why it matters now

Exploitation Active In CISA KEV since 2022-05-16CISA due date 2022-06-06
EPSS 0.99944 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZyxelUSG FLEX 100(W) firmware5.00 through 5.21 Patch 1—No fix listedCNA
ZyxelUSG FLEX 200 firmware5.00 through 5.21 Patch 1—No fix listedCNA
ZyxelUSG FLEX 500 firmware5.00 through 5.21 Patch 1—No fix listedCNA
ZyxelUSG FLEX 700 firmware5.00 through 5.21 Patch 1—No fix listedCNA
ZyxelATP series firmware5.10 through 5.21 Patch 1—No fix listedCNA
ZyxelVPN series firmware4.60 through 5.21 Patch 1—No fix listedCNA
ZyxelUSG FLEX 50(W) firmware5.10 through 5.21 Patch 1—No fix listedCNA
ZyxelUSG 20(W)-VPN firmware5.10 through 5.21 Patch 1—No fix listedCNA
  • USG FLEX 100(W) firmware VendorZyxel Affected 5.00 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • USG FLEX 200 firmware VendorZyxel Affected 5.00 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • USG FLEX 500 firmware VendorZyxel Affected 5.00 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • USG FLEX 700 firmware VendorZyxel Affected 5.00 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • ATP series firmware VendorZyxel Affected 5.10 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • VPN series firmware VendorZyxel Affected 4.60 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • USG FLEX 50(W) firmware VendorZyxel Affected 5.10 through 5.21 Patch 1 Fixed in — No fix listed CNA
  • USG 20(W)-VPN firmware VendorZyxel Affected 5.10 through 5.21 Patch 1 Fixed in — No fix listed CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*5.00 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*5.00 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*5.00 – 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*5.00 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*4.60 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:* Versions 5.00 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:* Versions 5.00 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:* Versions 5.00 – 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:* Versions 5.00 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:* Versions 4.60 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*4.60 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*4.60 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*4.60 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*5.10 to before 5.30VulnerableZyxel
cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*not specified by NVDRunning onZyxel
  • cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:* Versions 4.60 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:* Versions 4.60 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:* Versions 4.60 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
  • cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:* Versions 5.10 to before 5.30 Vulnerable ·Zyxel
  • cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2022-05-16 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-30525
  3. 2026-10-03 Alias added: GHSA-987m-9prq-3p7m

References

Exploit 3

Advisory 2

  • TI-2023-16198 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16197 Buffer overflow in Zyxel ATP series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13281 OS command injection in Zyxel ZyWALL/USG series firmware KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-17772 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-07267 OS command injection in Zyxel NAS326 KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-00268 Improper authentication in Zyxel USG/ZyWALL series firmware CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences