QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-30526

Back to search

CVE-2022-30526

Published: Jul 19, 2022

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

VendorProductVersions

Zyxel

USG FLEX 100(W) firmware

affected
4.50 through 5.30

Zyxel

USG FLEX 200 firmware

affected
4.50 through 5.30

Zyxel

USG FLEX 500 firmware

affected
4.50 through 5.30

Zyxel

USG FLEX 700 firmware

affected
4.50 through 5.30

Zyxel

ATP series firmware

affected
4.32 through 5.30

Zyxel

VPN series firmware

affected
4.30 through 5.30

Zyxel

USG FLEX 50(W) firmware

affected
4.16 through 5.30

Zyxel

USG 20(W)-VPN firmware

affected
4.16 through 5.30

Zyxel

USG/ZyWALL series firmware

affected
4.09 through 4.72

Weaknesses (CWE)

CWE-269

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now