CVE-2022-30526
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Zyxel firewall CLI commands where a local attacker can execute OS commands with root privileges in specific directories. It affects multiple Zyxel firewall product lines running vulnerable firmware versions. Attackers with local access can gain full system control.
💻 Affected Systems
- Zyxel USG FLEX 100(W)
- USG FLEX 200
- USG FLEX 500
- USG FLEX 700
- USG FLEX 50(W)
- USG20(W)-VPN
- ATP series
- VPN series
- USG/ZyWALL series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, exfiltrate configuration data, pivot to internal networks, or disable firewall protections entirely.
Likely Case
Local authenticated attacker gains root privileges to modify firewall rules, intercept traffic, or access sensitive configuration data stored on the device.
If Mitigated
With proper network segmentation and access controls limiting local access, impact is reduced to authorized administrators only.
🎯 Exploit Status
Exploit requires local CLI access but is straightforward once access is obtained. Public exploit code exists in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in firmware versions beyond the affected ranges (e.g., 5.31+ for most models)
Vendor Advisory: https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Zyxel support portal. 3. Backup configuration. 4. Upload and install firmware update. 5. Reboot device. 6. Verify updated version.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit local CLI access to trusted administrators only using access control lists and strong authentication.
Network Segmentation
allIsolate management interfaces from general network access to prevent unauthorized local access.
🧯 If You Can't Patch
- Implement strict access controls to limit who can access device CLI interfaces
- Monitor for unusual CLI activity and privilege escalation attempts in logs
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > Maintenance > Firmware) or CLI 'show version' command and compare to affected ranges.Check Version:
show versionVerify Fix Applied:
Verify firmware version is beyond affected ranges (e.g., 5.31+ for most models) and test CLI command restrictions.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command execution patterns
- Privilege escalation attempts in system logs
- Multiple failed authentication attempts followed by successful CLI access
Network Indicators:
- Unexpected management interface access from unusual IPs
- Anomalous traffic patterns post-CLI access
SIEM Query:
source="zyxel_firewall" AND (event_type="cli_command" AND command="*privilege*" OR command="*root*")🔗 References
- http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html
- https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
- http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html
- https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
