CVE-2022-30525 — Zyxel Multiple Firewalls OS Command Injection Vulnerability

provenance: imported · CVE: CVE-2022-30525

CVE-2022-30525: Zyxel Multiple Firewalls OS Command Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Zyxel
Product	Multiple Firewalls
Date added	2022-05-16
Due date	2022-06-06
Ransomware campaign use	Unknown

Description

A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2022-30525

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-30525
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog