CVE-2022-30525

Think of your router/firewall like the guard at your business’s front door. This bug lets a bad actor send a special web request that tricks the device into running operating-system commands—similar to getting the guard to open the back door and hand over the keys. If successful, attackers can change files and take control of the device.

This matters if you use or manage Zyxel firewall/VPN devices with firmware versions in the vulnerable ranges for the affected product set (USG FLEX/ATP/VPN models listed). The issue does not require a login or user action, so risk centers on whether the device is reachable from the network an attacker can access. Because network reachability is the gate, it’s most urgent when the management/web interface or the vulnerable CGI endpoint is exposed to the internet or otherwise reachable.

This is a RED issue because CISA confirmed the vulnerability as part of its KEV catalog (meaning it’s been treated as actively relevant) and the fix deadline has already passed. Attackers can trigger it over the network without authentication, so exposed devices are at immediate risk and should be updated to the fixed firmware version 5.30.

1. Confirm exposure

• Identify the exact model and current firmware version on each affected Zyxel device (USG FLEX 100W, USG FLEX 200, USG FLEX 500, USG FLEX 700, VPN100/VPN1000/VPN300/VPN50, ATP100/ATP100W/ATP200/ATP500/ATP700).
• Determine whether your firmware falls within the vulnerable ranges stated in the advisory (e.g., USG FLEX up to 5.21 Patch 1; VPN series up to 5.21 Patch 1; ATP series up to 5.21 Patch 1, as applicable).

2. Apply the fixed update

• Upgrade each affected branch to the vendor-fixed firmware version 5.30 (the findings list 5.30 as the fixed version across the affected model set).
• Use Zyxel’s provided upgrade guidance and only install updates from trusted sources.
• If you manage many sites, prioritize devices that are internet-reachable or exposed on the WAN.

3. Validate after upgrade

• Verify the device reports it is running firmware 5.30.
• Check device web/CGI access logs for unusual requests targeting web endpoints around the timeframe of exposure.

4. Temporary containment if patching is delayed

• Restrict network access to the device’s web/management interface so it is not reachable from the internet (and only accessible from trusted internal IPs/VPN admin networks).
• If your configuration supports it, disable any unused remote management services that provide access to the vulnerable CGI functionality.

5. What to monitor

• Continued probing attempts from new IPs (unexpected web requests to management/CGI paths).
• Configuration changes and file integrity changes (look for unexpected admin/config modifications after abnormal traffic).

CISA due date

• CISA remediation due date listed: 2022-06-06.

Severity/impact: Rated critical (CVSS 9.8) with capability for full operating-system control on affected devices. Weakness type: CWE-78 (OS command injection). Attack vector/mechanics: An attacker can send a crafted network request to the router’s web (CGI) interface; the injected content results in the modification of files and execution of arbitrary operating-system commands, effectively giving full control of the device.

Exploitation status: This issue is listed in CISA’s KEV catalog (added 2022-05-16) with a remediation due date of 2022-06-06, which indicates confirmed real-world relevance. The findings also indicate public exploit availability (4 known) and sustained press attention.

Reachability/authentication: The findings state authentication is not required and no user interaction is needed; the primary requirement is network access to reach the vulnerable CGI request path.

EPSS/exploit maturity: EPSS prediction is extremely high and rising, but the KEV listing is treated as the strongest indicator of real-world relevance for urgency.