Details of VAR-202205-0957

ID

VAR-202205-0957

CVE

CVE-2022-30525

TITLE

USG FLEX Operating system command injection vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202205-3104

DESCRIPTION

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device

Trust: 0.99

sources: NVD: CVE-2022-30525 // VULMON: CVE-2022-30525

AFFECTED PRODUCTS

vendor:	zyxel	model:	vpn300	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp100w	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	usg flex 50w	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	usg flex 200	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	vpn100	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp500	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	atp700	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	usg20w-vpn	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	atp500	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp100	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	usg flex 100w	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp200	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp800	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	vpn100	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	atp700	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	vpn1000	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 500	scope:	gte	version:	5.00	Trust: 1.0
vendor:	zyxel	model:	atp100w	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	vpn1000	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp100	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	usg flex 500	scope:	lte	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	vpn50	scope:	gte	version:	4.60	Trust: 1.0
vendor:	zyxel	model:	usg flex 700	scope:	gte	version:	5.00	Trust: 1.0
vendor:	zyxel	model:	usg flex 700	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	usg flex 200	scope:	gte	version:	5.00	Trust: 1.0
vendor:	zyxel	model:	vpn50	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	usg flex 50w	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	usg20w-vpn	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp800	scope:	lt	version:	5.30	Trust: 1.0
vendor:	zyxel	model:	atp200	scope:	gte	version:	5.10	Trust: 1.0
vendor:	zyxel	model:	usg flex 100w	scope:	gte	version:	5.00	Trust: 1.0
vendor:	zyxel	model:	vpn300	scope:	lt	version:	5.30	Trust: 1.0

sources: NVD: CVE-2022-30525

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-30525
value:	CRITICAL
Trust: 1.0
security@zyxel.com.tw:	CVE-2022-30525
value:	CRITICAL
Trust: 1.0
CNNVD:	CNNVD-202205-3104
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2022-30525
value:	HIGH
Trust: 0.1

NVD:
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
VULMON:	CVE-2022-30525
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

NVD:
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 2.0

sources: VULMON: CVE-2022-30525 // NVD: CVE-2022-30525 // NVD: CVE-2022-30525 // CNNVD: CNNVD-202205-3104

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.0

sources: NVD: CVE-2022-30525

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-3104

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202205-3104

CONFIGURATIONS

sources: NVD: CVE-2022-30525

PATCH

title:	Zyxel Technology USG FLEX Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=192898	Trust: 0.6
title:	-	url:	https://github.com/iveresk/cve-2022-30525	Trust: 0.1
title:	-	url:	https://github.com/pytersmithdarkghost/exploitcve202230525	Trust: 0.1
title:	-	url:	https://github.com/jbaines-r7/victorian_machinery	Trust: 0.1
title:	-	url:	https://github.com/ygoldking/cve-2022-30525	Trust: 0.1

sources: VULMON: CVE-2022-30525 // CNNVD: CNNVD-202205-3104

EXTERNAL IDS

db:	NVD	id:	CVE-2022-30525	Trust: 1.7
db:	PACKETSTORM	id:	167182	Trust: 1.6
db:	PACKETSTORM	id:	167372	Trust: 1.6
db:	PACKETSTORM	id:	168202	Trust: 1.6
db:	PACKETSTORM	id:	167176	Trust: 1.6
db:	CXSECURITY	id:	WLB-2022060004	Trust: 0.6
db:	CXSECURITY	id:	WLB-2022080075	Trust: 0.6
db:	CS-HELP	id:	SB2022051308	Trust: 0.6
db:	EXPLOIT-DB	id:	50946	Trust: 0.6
db:	CNNVD	id:	CNNVD-202205-3104	Trust: 0.6
db:	VULMON	id:	CVE-2022-30525	Trust: 0.1

sources: VULMON: CVE-2022-30525 // NVD: CVE-2022-30525 // CNNVD: CNNVD-202205-3104

REFERENCES

url:	http://packetstormsecurity.com/files/167182/zyxel-firewall-ztp-unauthenticated-command-injection.html	Trust: 2.2
url:	http://packetstormsecurity.com/files/167372/zyxel-usg-flex-5.21-command-injection.html	Trust: 2.2
url:	http://packetstormsecurity.com/files/167176/zyxel-remote-command-execution.html	Trust: 1.6
url:	http://packetstormsecurity.com/files/168202/zyxel-firewall-suid-binary-privilege-escalation.html	Trust: 1.6
url:	https://www.zyxel.com/support/zyxel-security-advisory-for-os-command-injection-vulnerability-of-firewalls.shtml	Trust: 1.6
url:	https://cxsecurity.com/issue/wlb-2022080075	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022051308	Trust: 0.6
url:	https://cxsecurity.com/issue/wlb-2022060004	Trust: 0.6
url:	https://www.exploit-db.com/exploits/50946	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-30525/	Trust: 0.6

sources: NVD: CVE-2022-30525 // CNNVD: CNNVD-202205-3104

CREDITS

jbaines-r7

Trust: 0.6

sources: CNNVD: CNNVD-202205-3104

SOURCES

db:	VULMON	id:	CVE-2022-30525
db:	NVD	id:	CVE-2022-30525
db:	CNNVD	id:	CNNVD-202205-3104

LAST UPDATE DATE

2023-12-18T13:59:38.680000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-30525	date:	2022-10-19T00:00:00
db:	NVD	id:	CVE-2022-30525	date:	2022-10-19T18:32:19.340
db:	CNNVD	id:	CNNVD-202205-3104	date:	2022-09-01T00:00:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-30525	date:	2022-05-12T00:00:00
db:	NVD	id:	CVE-2022-30525	date:	2022-05-12T14:15:07.053
db:	CNNVD	id:	CNNVD-202205-3104	date:	2022-05-12T00:00:00