CVE-2022-30526

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-30526
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html Exploit Third Party Advisory VDB Entry
https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*
History

13 Dec 2022, 15:38

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html - (MISC) http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry

31 Aug 2022, 19:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html -

29 Jul 2022, 22:02

Type Values Removed Values Added
First Time Zyxel vpn100 Firmware
Zyxel
Zyxel vpn1000 Firmware
Zyxel vpn100
Zyxel vpn1000
Zyxel usg Flex 700 Firmware
Zyxel usg60w
Zyxel atp800 Firmware
Zyxel usg60
Zyxel usg20w-vpn Firmware
Zyxel usg60 Firmware
Zyxel usg Flex 100w Firmware
Zyxel usg 2200-vpn Firmware
Zyxel usg Flex 100w
Zyxel usg60w Firmware
Zyxel atp700
Zyxel atp100 Firmware
Zyxel usg 2200-vpn
Zyxel vpn50 Firmware
Zyxel usg20w-vpn
Zyxel usg20-vpn
Zyxel atp200 Firmware
Zyxel usg40w
Zyxel usg Flex 200
Zyxel atp100
Zyxel usg40 Firmware
Zyxel atp200
Zyxel usg Flex 700
Zyxel zywall 110
Zyxel zywall 1100
Zyxel usg Flex 50w
Zyxel usg40
Zyxel atp700 Firmware
Zyxel atp800
Zyxel vpn300 Firmware
Zyxel vpn50
Zyxel zywall 310 Firmware
Zyxel zywall 110 Firmware
Zyxel atp500 Firmware
Zyxel usg40w Firmware
Zyxel zywall 310
Zyxel usg Flex 500
Zyxel zywall 1100 Firmware
Zyxel atp500
Zyxel usg Flex 50w Firmware
Zyxel atp100w Firmware
Zyxel atp100w
Zyxel usg Flex 200 Firmware
Zyxel vpn300
Zyxel usg20-vpn Firmware
Zyxel usg Flex 500 Firmware
CWE CWE-269
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn300:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_100w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_1100:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp100w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_2200-vpn:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg40w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp700:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn100:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_110:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg20w-vpn:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp800:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn1000:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_50w:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg40:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:vpn50:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg60w:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:zywall_310:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:atp200:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg60:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
References (CONFIRM) https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml - (CONFIRM) https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml - Vendor Advisory

19 Jul 2022, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-19 06:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-30526

Mitre link : CVE-2022-30526

CVE.ORG link : CVE-2022-30526

JSON object : View

Products Affected

zyxel

  • atp200_firmware
  • usg20-vpn_firmware
  • usg_flex_100w
  • usg_flex_700
  • atp800_firmware
  • atp700
  • usg_flex_50w_firmware
  • usg60
  • vpn300
  • zywall_1100
  • vpn100
  • zywall_310_firmware
  • usg40_firmware
  • usg40w
  • usg_flex_500_firmware
  • zywall_1100_firmware
  • zywall_310
  • usg60_firmware
  • usg_flex_100w_firmware
  • usg_flex_200
  • atp100
  • zywall_110
  • atp800
  • usg_flex_700_firmware
  • atp200
  • usg20-vpn
  • usg20w-vpn
  • vpn1000_firmware
  • vpn300_firmware
  • usg_2200-vpn
  • usg60w
  • atp500
  • atp700_firmware
  • usg40w_firmware
  • vpn50_firmware
  • usg_flex_500
  • atp100w
  • atp100w_firmware
  • usg_flex_200_firmware
  • vpn100_firmware
  • usg60w_firmware
  • usg_2200-vpn_firmware
  • usg_flex_50w
  • atp500_firmware
  • usg40
  • usg20w-vpn_firmware
  • atp100_firmware
  • zywall_110_firmware
  • vpn50
  • vpn1000
CWE
CWE-269

Improper Privilege Management