Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2022-30525

Quick assessment

Affected

Zyxel USG FLEX 100(W) firmware

Exploitation

Confirmed exploitation in the wild; remediate immediately

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zyxel USG FLEX是中国合勤科技（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。合勤科技 USG FLEX 5.00版本至5.21版本、存在安全漏洞。攻击者利用该漏洞修改特定文件，在易受攻击的设备上执行一些操作系统命令。

CVSS 9.8 · Critical KEV EPSS 99.94% · P100 Updated Feb 25, 2026

Public Exploits 3

ExploitDB · 1 EDB-50946 [remote]

Metasploit · 1 zyxel_ztp_rce.rb [exploit]

Nuclei · 1 CVE-2022-30525.yaml [template]

In-the-Wild Activity Observed cisa_kev · confirmed

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-30525

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Vulnerability Title

合勤科技 USG FLEX 操作系统命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor	Product	Affected Versions	CPE
Zyxel	USG FLEX 100(W) firmware	5.00 through 5.21 Patch 1	-
Zyxel	USG FLEX 200 firmware	5.00 through 5.21 Patch 1	-
Zyxel	USG FLEX 500 firmware	5.00 through 5.21 Patch 1	-
Zyxel	USG FLEX 700 firmware	5.00 through 5.21 Patch 1	-
Zyxel	ATP series firmware	5.10 through 5.21 Patch 1	-
Zyxel	VPN series firmware	4.60 through 5.21 Patch 1	-
Zyxel	USG FLEX 50(W) firmware	5.10 through 5.21 Patch 1	-
Zyxel	USG 20(W)-VPN firmware	5.10 through 5.21 Patch 1	-

II. Public POCs for CVE-2022-30525

#	POC Description	Source Link	Shenlong Link
1	Proof of concept exploit for CVE-2022-30525 (Zxyel firewall command injection)	https://github.com/jbaines-r7/victorian_machinery	POC Details
2	Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）	https://github.com/Henry4E36/CVE-2022-30525	POC Details
3	Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）批量检测脚本	https://github.com/shuai06/CVE-2022-30525	POC Details
4	Zyxel 防火墙未经身份验证的远程命令注入	https://github.com/savior-only/CVE-2022-30525	POC Details
5	Zyxel Firewall Remote Command Injection Vulnerability (CVE-2022-30525) Batch Detection Script	https://github.com/M4fiaB0y/CVE-2022-30525	POC Details
6	CVE-2022-30525（Zxyel 防火墙命令注入）的概念证明漏洞利用	https://github.com/k0sf/CVE-2022-30525	POC Details
7	CVE-2022-30525 POC exploit	https://github.com/superzerosec/CVE-2022-30525	POC Details
8	Simple python script to exploit CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection	https://github.com/Chocapikk/CVE-2022-30525-Reverse-Shell	POC Details
9	CVE-2022-30525 Zyxel防火墙命令注入漏洞 POC&EXP	https://github.com/160Team/CVE-2022-30525	POC Details
10	Simple python script to exploit CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection	https://github.com/zhefox/CVE-2022-30525-Reverse-Shell	POC Details
11	Initial POC for the CVE-2022-30525	https://github.com/iveresk/cve-2022-30525	POC Details
12	CVE-2022-30525 Zyxel 防火墙命令注入漏洞 POC&EXPC	https://github.com/west9b/CVE-2022-30525	POC Details
13	A OS Command Injection Vulnerability in the CGI Program of Zyxel	https://github.com/furkanzengin/CVE-2022-30525	POC Details
14	CVE-2022-30525 POC	https://github.com/ProngedFork/CVE-2022-30525	POC Details
15	None	https://github.com/cbk914/CVE-2022-30525_check	POC Details
16	Exploit for CVE-2022-30525	https://github.com/arajsingh-infosec/CVE-2022-30525_Exploit	POC Details
17	Simple python script to exploit CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection	https://github.com/5l1v3r1/CVE-2022-30525-Reverse-Shell	POC Details
18	An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-30525.yaml	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2022-30525

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2022-30525 (4)

http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html x_refsource_MISC
http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html x_refsource_MISC
http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html x_refsource_MISC
http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html x_refsource_MISC

Other References for CVE-2022-30525 (1)

https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2022-30525

IV. Related Vulnerabilities

Same product: USG FLEX 100(W) firmware

Same vendor: Zyxel

Same weakness: CWE-78

V. Comments for CVE-2022-30525

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-30525

Quick assessment

Public Exploits 3

Possible ATT&CK Techniques 2 AI

I. Basic Information for CVE-2022-30525

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Shenlong Deep Dive — AI Deep Analysis

Affected Products

II. Public POCs for CVE-2022-30525

III. Intelligence Information for CVE-2022-30525

Exploits & Public PoCs for CVE-2022-30525 (4)

Other References for CVE-2022-30525 (1)

IV. Related Vulnerabilities

V. Comments for CVE-2022-30525

Leave a comment