CVE-2022-30525: Zyxel firewall CGI OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote OS command injection on internet-facing perimeter devices, with CVSS 9.8, KEV listing and near-maximum EPSS, makes this an urgent patch-first item.

What it is

The CGI program in multiple Zyxel firewall and VPN firmware lines fails to neutralize OS command syntax, allowing command injection. The flaw affects USG FLEX, USG20(W)-VPN, ATP and VPN series devices running firmware 5.00 through 5.21 Patch 1 (4.60 for VPN series). It matters because these are internet-facing perimeter devices and the issue is remotely reachable without credentials.

Impact

An unauthenticated attacker can modify specific files and execute arbitrary OS commands on the device, gaining full control of the firewall. That yields high confidentiality, integrity and availability impact, including potential use of the device as a pivot into the internal network.

Attack surface

Reached over the network through the device's CGI interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The description does not name the exact endpoint or parameter, only that the CGI program is the injection point.

Exploitation

CISA added it to the KEV catalog on 2022-05-16 with a 2022-06-06 remediation due date, and public exploit references are tagged Exploit on Packet Storm. EPSS is 0.99944 (99.972 percentile), indicating very high predicted exploitation activity; KEV lists no known ransomware campaign use.

What to do

• Apply the vendor firmware update per the Zyxel security advisory, upgrading affected USG FLEX, USG20(W)-VPN, ATP and VPN series devices past 5.21 Patch 1.
• Until patching is complete, remove management and CGI access from untrusted networks and restrict it to trusted administrative hosts.
• Disable or block remote management (HTTP/HTTPS admin, and any WAN-facing ZTP or CGI endpoints) where operationally possible.
• Monitor vendor advisories and CISA KEV for updated guidance, and inventory all listed models to confirm which remain unpatched.
• If a device cannot be patched, isolate it on a segmented management network and treat it as untrusted.

Detection

• Review firewall and web logs for requests to CGI endpoints from unexpected external source IPs, especially patterns suggesting command separators or shell metacharacters.
• Alert on unexpected outbound connections or new processes originating from the firewall/VPN device itself.
• Check device configuration and filesystem for unauthorized modifications, and compare against known-good baselines.
• Hunt for signs of post-exploitation activity such as added accounts, changed admin credentials, or altered firewall rules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.