Multiple vulnerabilities in Zyxel products

Published: 2022-07-19 | Updated: 2022-09-01

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-30526 CVE-2022-2030
CWE-ID	CWE-264 CWE-22
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software Subscribe	USG FLEX 200 Hardware solutions / Firmware USG FLEX 100W Hardware solutions / Firmware USG FLEX 500 Hardware solutions / Firmware USG FLEX 700 Hardware solutions / Firmware USG FLEX 50W Hardware solutions / Firmware USG20W-VPN Hardware solutions / Firmware ATP series Hardware solutions / Routers for home users VPN series Client/Desktop applications / Antivirus software/Personal firewalls USG series Client/Desktop applications / Antivirus software/Personal firewalls ZyWALL Other software / Other software solutions
Vendor	ZyXEL Communications Corp.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65410

Risk: Low

CVSSv3.1: 7.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2022-30526

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the CLI command. A local attacker can execute arbitrary OS commands with root privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

USG FLEX 200: 4.50 - 5.30

USG FLEX 100W: 4.50 - 5.30

USG FLEX 500: 4.50 - 5.30

USG FLEX 700: 4.50 - 5.30

USG FLEX 50W: 4.16 - 5.30

USG20W-VPN: 4.16 - 5.30

ATP series: 4.32 - 5.30

VPN series: 4.30 - 5.30

USG series: 4.09 - 4.72

ZyWALL: 4.09 - 4.72

External links

http://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) Path traversal

EUVDB-ID: #VU65413

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2030

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No