{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2022-035.pdf"
    },
    "title": "Critical Remote Code Execution in Zyxel Products",
    "serial_number": "2022-035",
    "publish_date": "17-05-2022 08:02:00",
    "description": "In April 2022, a security researcher from Rapid7 discovered and reported a vulnerability that affects Zyxel firewall and VPN devices for business (advisory publicly released on 12th May 2022). Tracked as CVE-2022-30525 with a CVSS score of 9.8, a successful exploitation of this vulnerability allows an unauthenticated and remote attacker to achieve code execution as the \"nobody\" user.<br>A public exploit is available and a module had been added to the Metasploit penetration testing framework. This vulnerability is currently exploited in the wild by attackers to get access to information systems.<br>It is strongly recommended to apply the vendor patch as soon as possible.",
    "url_title": "2022-035",
    "content_markdown": "---\ntitle: 'Critical Remote Code Execution in\u00a0Zyxel\u00a0Products'\nversion: '1.0'\nnumber: '2022-035'\ndate: 'May 17, 2022'\n---\n\n_History:_\n\n* _17/05/2022 --- v1.0 -- Initial publication_\n\n# Summary\n\nIn April 2022, a security researcher from Rapid7 discovered and reported a vulnerability that affects Zyxel firewall and VPN devices for business (advisory publicly released on 12th May 2022). Tracked as CVE-2022-30525 with a CVSS score of 9.8, a successful exploitation of this vulnerability allows an **unauthenticated and remote** attacker to achieve **code execution** as the `nobody` user [1].\n\nA public exploit is available and a module had been added to the Metasploit penetration testing framework. This vulnerability is currently exploited in the wild by attackers to get access to information systems [2].\n\nIt is **strongly** recommended to apply the vendor patch as soon as possible.\n\n# Technical Details\n\nThe affected products are vulnerable to unauthenticated and remote command injection via the administrative HTTP interface. This vulnerability is exploited through the `/ztp/cgi-bin/handler` URI and is the result of passing unsanitized attacker input into the `os.system` method in `lib_wan_settings.py`. The vulnerable functionality is invoked in association with the `setWanPortSt` command. An attacker can inject arbitrary commands into the `mtu` or the `data` parameter [1].\n\n# Affected Products\n\nThe list of affected products is following [2]: \n\n| Affected Models | Impacted version | Fixed Version |\n|--------------------------------|---------------------------------|---------------|\n|USG FLEX 100, 100W, 200, 500, 700 | ZLD5.00 through ZLD5.21 Patch 1| ZLD V5.30 |\n|USG FLEX 50(W), USG20(W)-VPN | ZLD5.10 through ZLD5.21 Patch 1| ZLD V5.30 |\n|ATP series | ZLD5.10 through ZLD5.21 Patch 1| ZLD V5.30 |\n|VPN series | ZLD V4.60 through ZLD V5.21 Patch 1 | ZLD V5.30 |\n\n# Recommendations\n\nCERT-EU strongly recommends to apply the vendor patch as soon as possible. It can be done by enabling automatic firmware update.\n\n# References\n\n[1] <https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/>\n\n[2] <https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-zyxel-firewalls-and-vpns/>\n\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>17/05/2022 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>In April 2022, a security researcher from Rapid7 discovered and reported a vulnerability that affects Zyxel firewall and VPN devices for business (advisory publicly released on 12th May 2022). Tracked as CVE-2022-30525 with a CVSS score of 9.8, a successful exploitation of this vulnerability allows an <strong>unauthenticated and remote</strong> attacker to achieve <strong>code execution</strong> as the <code>nobody</code> user [1].</p><p>A public exploit is available and a module had been added to the Metasploit penetration testing framework. This vulnerability is currently exploited in the wild by attackers to get access to information systems [2].</p><p>It is <strong>strongly</strong> recommended to apply the vendor patch as soon as possible.</p><h2 id=\"technical-details\">Technical Details</h2><p>The affected products are vulnerable to unauthenticated and remote command injection via the administrative HTTP interface. This vulnerability is exploited through the <code>/ztp/cgi-bin/handler</code> URI and is the result of passing unsanitized attacker input into the <code>os.system</code> method in <code>lib_wan_settings.py</code>. The vulnerable functionality is invoked in association with the <code>setWanPortSt</code> command. An attacker can inject arbitrary commands into the <code>mtu</code> or the <code>data</code> parameter [1].</p><h2 id=\"affected-products\">Affected Products</h2><p>The list of affected products is following [2]: </p><table><thead><tr><th>Affected Models</th><th>Impacted version</th><th>Fixed Version</th></tr></thead><tbody><tr><td>USG FLEX 100, 100W, 200, 500, 700</td><td>ZLD5.00 through ZLD5.21 Patch 1</td><td>ZLD V5.30</td></tr><tr><td>USG FLEX 50(W), USG20(W)-VPN</td><td>ZLD5.10 through ZLD5.21 Patch 1</td><td>ZLD V5.30</td></tr><tr><td>ATP series</td><td>ZLD5.10 through ZLD5.21 Patch 1</td><td>ZLD V5.30</td></tr><tr><td>VPN series</td><td>ZLD V4.60 through ZLD V5.21 Patch 1</td><td>ZLD V5.30</td></tr></tbody></table><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU strongly recommends to apply the vendor patch as soon as possible. It can be done by enabling automatic firmware update.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/\">https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-zyxel-firewalls-and-vpns/\">https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-zyxel-firewalls-and-vpns/</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}