CVE-2022-0556

—

CVSS 3.1

7.8 high

EPSS

<1%p30

Published

Apr 11, 2022 (Apr 11, 2022)

Modified

Jun 17, 2026

Description

A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.

Vendors: zyxel
Products: zyxel ap configurator
Weakness: CWE-269, CWE-732
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news2 stories

Zyxel fixed firewall unauthenticated remote command injection issue

Security AffairsMay 17, 06:47 UTC · May 17, 2022Exploit / PoC CVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs

Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability

The Hacker NewsMay 15, 00:00 UTC · May 15, 2022Vulnerability in the wildCVE-2022-30525 CVE-2022-26413 CVE-2022-26414+1 CVEs