Multiple vulnerabilities in Zyxel products
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-30526 CVE-2022-2030 |
| CWE-ID | CWE-264 CWE-22 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
USG FLEX 200 Hardware solutions / Firmware USG FLEX 100W Hardware solutions / Firmware USG FLEX 500 Hardware solutions / Firmware USG FLEX 700 Hardware solutions / Firmware USG FLEX 50W Hardware solutions / Firmware USG20W-VPN Hardware solutions / Firmware ATP series Hardware solutions / Routers for home users VPN series Client/Desktop applications / Antivirus software/Personal firewalls USG series Client/Desktop applications / Antivirus software/Personal firewalls ZyWALL Other software / Other software solutions |
| Vendor | ZyXEL Communications Corp. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU65410
Risk: Low
CVSSv4.0: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]
CVE-ID: CVE-2022-30526
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: Yes
DescriptionThe vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the CLI command. A local attacker can execute arbitrary OS commands with root privileges.
MitigationInstall updates from vendor's website.
Vulnerable software versionsUSG FLEX 200: 4.50 - 5.30
USG FLEX 100W: 4.50 - 5.30
USG FLEX 500: 4.50 - 5.30
USG FLEX 700: 4.50 - 5.30
USG FLEX 50W: 4.16 - 5.30
USG20W-VPN: 4.16 - 5.30
ATP series: 4.32 - 5.30
VPN series: 4.30 - 5.30
USG series: 4.09 - 4.72
ZyWALL: 4.09 - 4.72
CPE2.3- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_700:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_50w:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg20w-vpn:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:atp_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:vpn_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:usg_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:zywall:*:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
2) Path traversal
EUVDB-ID: #VU65413
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-2030
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in some CGI programs. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsUSG FLEX 200: 4.50 - 5.30
USG FLEX 100W: 4.50 - 5.30
USG FLEX 500: 4.50 - 5.30
USG FLEX 700: 4.50 - 5.30
USG FLEX 50W: 4.16 - 5.30
USG20W-VPN: 4.16 - 5.30
ATP series: 4.32 - 5.30
VPN series: 4.30 - 5.30
USG series: 4.11 - 4.72
ZyWALL: 4.11 - 4.72
CPE2.3- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_200:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_100w:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:4.50:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_500:5.30:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_700:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg_flex_50w:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:usg20w-vpn:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel_communications_corp:atp_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:vpn_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:usg_series:*:*:*:*:*:*:*:*
- cpe:2.3:a:zyxel_communications_corp:zywall:*:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
