---
id: "CVE-2022-30525"
kind: "vulnerability"
aliases: ["CVE-2022-30525"]
title: "Zyxel Multiple Firewalls: Zyxel Multiple Firewalls OS Command Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99944
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zyxel Multiple Firewalls", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "firewall", "infrastructure", "self-hosted", "zyxel"]
not_affected_if: ["unknown"]
published_at: "2022-05-12T14:15:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-30525", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-30525", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30525", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Zyxel Multiple Firewalls: Zyxel Multiple Firewalls OS Command Injection Vulnerability

Some Zyxel firewall firmware versions have an OS command injection flaw in their CGI program. An attacker can modify specific files and run operating system commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zyxel Multiple Firewalls affected ? fixed ?

## How to check

Check the firewall firmware version against the Zyxel advisory for CVE-2022-30525; the affected versions are not listed in the sources.

## Fix

Apply the vendor firmware update per Zyxel's instructions (CISA KEV required action); the fixed version is not named in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-30525
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-30525
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-30525

## From the sources

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_