Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

githubexploit · 2022-05-13

Description

Zyxel Usg Flex 100W Firmware OS Command Injectio

Entry point

Parametercommand · request body

Pathztp/cgi-bin/handler

OS command injection via ztp/cgi-bin/handler allowing execution of arbitrary shell commands

Affected Zyxel Usg Flex 100w Firmware versions

Zyxel Usg Flex 100w Firmware< 5.30

All known vulnerabilities by product

Zyxel Atp Series Zyxel Usg Flex 100 Zyxel Usg Flex 200 Zyxel Usg Flex 50 Zyxel Usg Flex 500 Zyxel Usg Flex 700 Zyxel Usg20(W)-Vpn Zyxel Vpn Series

CVSS 10.0 for CVE-2022-30525

10.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

97%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

99.9%higher than 100.0% of all CVEs

Updated 2026-07-30

Exploit Details

Modified:2023-06-14 05:55

Last Seen:2025-08-31 21:20

Reporter:savior-only

Written in:Python

Last commit:2022-05-14

Tags

zyxelusg flex 100wfirmwareos command injectionCVE-2022-30525securityexploitauthentication bypassremote command injectionvulnerabilityupdatepatch 1proxy

Other exploits for CVE-2022-30525

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

2024-02-27 arajsingh-infosecGITHUB

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

2023-01-15 cbk914GITHUB

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

2023-01-13 VegetaGITEE

Zyxel Firewall SUID Binary Privilege Escalation Exploit

2022-09-02 Martin HeilandZDTRuby

Zyxel Firewall SUID Binary Privilege Escalation

2022-08-31 jbaines-r7, metasploit.comPACKETSTORMRuby

Zyxel Firewall SUID Binary Privilege Escalation

2022-06-14 jbaines-r7METASPLOITRuby

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

2022-06-13 ProngedForkGITHUB

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

2022-06-12 furkanzenginGITHUB

Exploit Code

README28 lines

## https://sploitus.com/exploit?id=85E31D02-8EDA-5C9D-BF05-D41E04B2F6A6
# CVE-2022-30525  
Zyxel firewall: Unauthenticated remote command injection  

## Affected Versions  

### Affected Components  

USG FLEX 100, 100W, 200, 500, 700  
USG20-VPN, USG20W-VPN  
ATP 100, 200, 500, 700, 800  

### Firmware Versions  

ZLD5.00 through ZLD5.21 Patch 1  
ZLD5.10 through ZLD5.21 Patch 1  
ZLD5.10 through ZLD5.21 Patch 1  

## Updates  

-Proxy  

## Source  
https://github.com/Henry4E36/CVE-2022-30525  

# ⚠️ Disclaimer  

This tool is used solely for cybersecurity research and discussion purposes. Please use it in a reasonable manner in accordance with network security laws! If users engage in illegal activities using this tool, it is not related to this author.