Live › vulnerability › CVE-2022-30525
Go to dashboardSome Zyxel firewall firmware versions have an OS command injection flaw in their CGI program. An attacker can modify specific files and run operating system commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zyxel Multiple Firewalls | vendor | – | – |
Check the firewall firmware version against the Zyxel advisory for CVE-2022-30525; the affected versions are not listed in the sources.
Apply the vendor firmware update per Zyxel's instructions (CISA KEV required action); the fixed version is not named in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
This page as .md · .json · in your agent: get_signal("CVE-2022-30525")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.