Exploit / PoCcritical
Zyxel fixed firewall unauthenticated remote command injection issue
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-0556 | A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4… | 7.8 | <1% | ||
CVE-2022-26413+1 related CVE | A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to… | 8.0 group max | <1% | ||
| CVE-2022-30525 | OS Command Injection in Zyxel Firewalls Enables Remote Command Execution | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
2 min read at securityaffairs.com
Zyxel addressed a critical flaw affecting Zyxel firewall devices that allows unauthenticated, remote attackers to gain arbitrary code execution. Zyxel has moved to address a critical security vulnerability (CVE-2022-30525, CVSS score: 9. 8) affecting Zyxel firewall devices that enables unauthenticated and remote attackers to gain arbitrary code execution as the “nobody” user.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.