7.8

CVE-2022-30526

Exploit

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

Data is provided by the National Vulnerability Database (NVD)
Zyxel ≫ Usg Flex 100w Firmware Version >= 4.50 <= 5.30
   Zyxel ≫ Usg Flex 100w Version-
Zyxel ≫ Usg Flex 200 Firmware Version >= 4.50 <= 5.30
   Zyxel ≫ Usg Flex 200 Version-
Zyxel ≫ Usg Flex 500 Firmware Version >= 4.50 <= 5.30
   Zyxel ≫ Usg Flex 500 Version-
Zyxel ≫ Usg Flex 700 Firmware Version >= 4.50 <= 5.30
   Zyxel ≫ Usg Flex 700 Version-
Zyxel ≫ Usg Flex 50w Firmware Version >= 4.16 <= 5.30
   Zyxel ≫ Usg Flex 50w Version-
Zyxel ≫ Usg20w-vpn Firmware Version >= 4.16 <= 5.30
   Zyxel ≫ Usg20w-vpn Version-
Zyxel ≫ Atp800 Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp800 Version-
Zyxel ≫ Atp700 Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp700 Version-
Zyxel ≫ Atp500 Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp500 Version-
Zyxel ≫ Atp200 Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp200 Version-
Zyxel ≫ Atp100w Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp100w Version-
Zyxel ≫ Atp100 Firmware Version >= 4.32 <= 5.30
   Zyxel ≫ Atp100 Version-
Zyxel ≫ Vpn1000 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Vpn1000 Version-
Zyxel ≫ Vpn300 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Vpn300 Version-
Zyxel ≫ Vpn100 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Vpn100 Version-
Zyxel ≫ Vpn50 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Vpn50 Version-
Zyxel ≫ Usg20-vpn Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Usg20-vpn Version-
Zyxel ≫ Usg 2200-vpn Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Usg 2200-vpn Version-
Zyxel ≫ Zywall 110 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Zywall 110 Version-
Zyxel ≫ Zywall 310 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Zywall 310 Version-
Zyxel ≫ Zywall 1100 Firmware Version >= 4.30 <= 5.30
   Zyxel ≫ Zywall 1100 Version-
Zyxel ≫ Usg40 Firmware Version >= 4.09 <= 4.72
   Zyxel ≫ Usg40 Version-
Zyxel ≫ Usg40w Firmware Version >= 4.09 <= 4.72
   Zyxel ≫ Usg40w Version-
Zyxel ≫ Usg60 Firmware Version >= 4.09 <= 4.72
   Zyxel ≫ Usg60 Version-
Zyxel ≫ Usg60w Firmware Version >= 4.09 <= 4.72
   Zyxel ≫ Usg60w Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 3.89% 0.878
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@zyxel.com.tw 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.