{"id":"CVE-2022-30525","kind":"vulnerability","aliases":["CVE-2022-30525"],"related":[],"title":"Zyxel Multiple Firewalls: Zyxel Multiple Firewalls OS Command Injection Vulnerability","description":"A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.","summary":"Some Zyxel firewall firmware versions have an OS command injection flaw in their CGI program. An attacker can modify specific files and run operating system commands on the device.","severity":"critical","cvss":10.0,"epss":0.99944,"exploited":true,"exploited_at":"2022-05-16T00:00:00+00:00","products":[{"name":"Zyxel Multiple Firewalls","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","infrastructure","self-hosted","zyxel"],"not_affected_if":["unknown"],"how_to_check":"Check the firewall firmware version against the Zyxel advisory for CVE-2022-30525; the affected versions are not listed in the sources.","fix":"Apply the vendor firmware update per Zyxel's instructions (CISA KEV required action); the fixed version is not named in the sources.","status":"open","published_at":"2022-05-12T14:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:17:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update per Zyxel's instructions (CISA KEV required action); the fixed version is not named in the sources.","reach":"unknown","impact":"high","summary":"Some Zyxel firewall firmware versions have an OS command injection flaw in their CGI program. An attacker can modify specific files and run operating system commands on the device.","category":"infrastructure","who_cares":["zyxel","firewall","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs OS commands on the firewall and modifies files","analyst_note":"Find the affected firmware versions, fixed versions and exposed-interface conditions in Zyxel's advisory for CVE-2022-30525; exploitation is confirmed by CISA KEV.","how_to_check":"Check the firewall firmware version against the Zyxel advisory for CVE-2022-30525; the affected versions are not listed in the sources.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000481,"input_tokens":2853,"output_tokens":392,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':12A,15A '-30525':13A,16A '1':77C,87C,97C,107C,118C,128C,137C,146C '100':69C '200':80C '4.60':142C '5.00':73C,83C,93C,103C '5.10':114C,124C,133C '5.21':75C,85C,95C,105C,116C,126C,135C,144C '50':110C '500':90C '700':100C 'allow':149C 'atp':129C 'attack':43B,151C 'cgi':40B,63C 'command':8A,35B,52B,58C,161C 'could':148C 'cve':11A,14A 'devic':55B,165C 'execut':158C 'exploit':20B 'file':47B,155C 'firewal':3A,6A,21B,29B 'firewalls':19A 'firmwar':30B,71C,81C,91C,101C,112C,122C,131C,140C 'flaw':37B 'flex':68C,79C,89C,99C,109C 'host':25B 'infrastructur':22B 'inject':9A,36B,59C 'modifi':45B,153C 'multipl':2A,5A 'multiple':18A 'oper':50B 'os':7A,34B,57C,160C 'patch':76C,86C,96C,106C,117C,127C,136C,145C 'program':41B,64C 'run':49B 'self':24B 'self-host':23B 'seri':130C,139C 'specif':46B,154C 'system':51B 'usg':67C,78C,88C,98C,108C 'usg20':119C 'version':31B,72C,82C,92C,102C,113C,123C,132C,141C 'vpn':121C,138C 'vulner':10A,60C,164C 'w':70C,111C,120C 'zyxel':1A,4A,17A,26B,28B,66C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-05-12T14:15:07+00:00","kev":{"dateAdded":"2022-05-16","dueDate":"2022-06-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@zyxel.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-30525","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-30525","severity":null,"published_at":"2022-05-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:24+00:00","note":null},{"source":"epss","external_id":"CVE-2022-30525","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-30525","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-30525","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30525","severity":null,"published_at":"2022-05-12T14:15:07+00:00","modified_at":"2026-06-17T04:43:46+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}