Skip to main content

Vpn100 Firmware CVE-2022-26532

HIGH
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2022-05-24 security@zyxel.com.tw
Code Injection Zyxel Vpn100 Firmware Vpn1000 Firmware Vpn300 Firmware Vpn50 Firmware Atp100 Firmware Atp100W Firmware Atp200 Firmware Atp500 Firmware Atp700 Firmware Atp800 Firmware Usg 110 Firmware Usg 1100 Firmware Usg 1900 Firmware Usg 20W Firmware Usg 20W Vpn Firmware Usg 2200 Vpn Firmware Usg 310 Firmware Usg 40 Firmware Usg 40W Firmware Usg 60 Firmware Usg 60W Firmware Usg Flex 100 Firmware Usg Flex 100W Firmware Usg Flex 200 Firmware Usg Flex 500 Firmware Usg Flex 700 Firmware Usg200 Firmware Usg20 Firmware Usg210 Firmware Usg2200 Firmware Usg300 Firmware Usg310 Firmware Nsg300 Firmware Nsg100 Firmware Nsg50 Firmware Nxc2500 Firmware Nxc5500 Firmware Nap203 Firmware Nap303 Firmware Nap353 Firmware Nwa50Ax Firmware Nwa55Axe Firmware Nwa90Ax Firmware Nwa110Ax Firmware Nwa210Ax Firmware Nwa1123 Ac Hd Firmware Nwa1123 Ac Pro Firmware Nwa1123Acv3 Firmware Nwa1302 Ac Firmware Nwa5123 Ac Hd Firmware Wac500H Firmware Wac500 Firmware Wac5302D S Firmware Wac5302D Sv2 Firmware Wac6103D I Firmware Wac6303D S Firmware Wac6502D E Firmware Wac6502D S Firmware Wac6503D S Firmware Wac6553D S Firmware Wac6552D S Firmware Wax510D Firmware Wax610D Firmware Wax630S Firmware Wax650S Firmware
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 24, 2022 - 06:15 nvd
HIGH 7.8

DescriptionNVD

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.

AnalysisAI

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-88. A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command. Affected products include: Zyxel Vpn100 Firmware, Zyxel Vpn1000 Firmware, Zyxel Vpn300 Firmware, Zyxel Vpn50 Firmware, Zyxel Atp100 Firmware. Version information: through 4.71.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Vpn100 Firmware

View all
CVE-2023-28771 CRITICAL POC
9.8 Apr 25

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware vers
CVE-2022-30525 CRITICAL POC
9.8 May 12

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
CVE-2022-0342 CRITICAL POC
9.8 Mar 28

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70
CVE-2020-29583 CRITICAL POC
9.8 Dec 22

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. Rated
CVE-2020-9054 CRITICAL POC
9.8 Mar 04

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command
CVE-2019-9955 MEDIUM POC
6.1 Apr 22

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, U
CVE-2023-33010 CRITICAL
9.8 May 24

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Pa
CVE-2023-33009 CRITICAL
9.8 May 24

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Pat
CVE-2023-27991 HIGH
8.8 Apr 24

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 th
CVE-2023-22916 HIGH
8.1 Apr 24

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00
CVE-2023-22913 HIGH
8.1 Apr 24

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series
CVE-2022-26531 HIGH
7.8 May 24

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versio

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2024-39930 CRITICAL POC
9.9

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2022-26532 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy