VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published May 12, 2022· Updated Jun 17, 2026

CVE-2022-30525

CVE-2022-30525

Description

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

32
  • Zyxel/Usg Flex 100w Firmware
    cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
    Range: >=5.00,<5.30
  • Zyxel/Usg Flex 200 Firmware
    cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
    Range: >=5.00,<5.30
  • Zyxel/Usg Flex 500 Firmware2 versions
    cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*range: >=5.00,<=5.30
    • (no CPE)range: 5.00 through 5.21 Patch 1
  • Zyxel/Usg Flex 700 Firmware2 versions
    cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*range: >=5.00,<5.30
    • (no CPE)range: 5.00 through 5.21 Patch 1
  • Zyxel/Vpn100 Firmware
    cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*
    Range: >=4.60,<5.30
  • Zyxel/Vpn1000 Firmware
    cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*
    Range: >=4.60,<5.30
  • Zyxel/Vpn300 Firmware
    cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*
    Range: >=4.60,<5.30
  • Zyxel/Vpn50 Firmware
    cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*
    Range: >=4.60,<5.30
  • Zyxel/Atp100 Firmware
    cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Atp100w Firmware
    cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Atp200 Firmware
    cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Atp500 Firmware
    cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Atp700 Firmware
    cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Atp800 Firmware
    cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Usg Flex 50w Firmware
    cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/Usg20w VPN Firmware
    cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
    Range: >=5.10,<5.30
  • Zyxel/USG FLEX 100(W)cpe-rescue2 versions
    5.00 through 5.21 Patch 1+ 1 more
    • (no CPE)range: 5.00 through 5.21 Patch 1
    • (no CPE)range: 5.00 - 5.21 Patch 1
  • Zyxel/USG FLEX 200cpe-rescue2 versions
    5.00 through 5.21 Patch 1+ 1 more
    • (no CPE)range: 5.00 through 5.21 Patch 1
    • (no CPE)range: 5.00 - 5.21 Patch 1
  • Zyxel/VPN seriescpe-rescue2 versions
    4.60 through 5.21 Patch 1+ 1 more
    • (no CPE)range: 4.60 through 5.21 Patch 1
    • (no CPE)range: 4.60 - 5.21 Patch 1
  • Zyxel/ATP seriescpe-rescue2 versions
    5.10 through 5.21 Patch 1+ 1 more
    • (no CPE)range: 5.10 through 5.21 Patch 1
    • (no CPE)range: 5.10 - 5.21 Patch 1
  • Zyxel/Usg20 VPN Firmwarecpe-rescue
    Range: 5.10 through 5.21 Patch 1
  • Zyxel/USG FLEX 50(W)cpe-rescue2 versions
    5.10 through 5.21 Patch 1+ 1 more
    • (no CPE)range: 5.10 through 5.21 Patch 1
    • (no CPE)range: 5.10 - 5.21 Patch 1
  • Zyxel/USG FLEX 700llm-create
    Range: 5.00 - 5.21 Patch 1
  • Zyxel/USG FLEX 500llm-create
    Range: 5.00 - 5.21 Patch 1
  • Zyxel/USG20-VPNllm-fuzzy
    Range: 5.10 - 5.21 Patch 1

Patches

Vulnerability mechanics

References

6

News mentions

2