Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-26532

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.8, requiring local system access to exploit with relatively low complexity without requiring user interaction requiring only low-level privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 130 products from zyxel, from zyxel, from zyxel and 127 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2022, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2022-05-24T06:15:09.390

Last Modified

2024-11-21T06:54:07.663

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Secondary
CWE-88
Type: Primary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	zyxel	vpn100_firmware	≤ 5.21	Yes
Hardware	zyxel	vpn100	-	No
Operating System	zyxel	vpn1000_firmware	≤ 5.21	Yes
Hardware	zyxel	vpn1000	-	No
Operating System	zyxel	vpn300_firmware	≤ 5.21	Yes
Hardware	zyxel	vpn300	-	No
Operating System	zyxel	vpn50_firmware	≤ 5.21	Yes
Hardware	zyxel	vpn50	-	No
Operating System	zyxel	atp100_firmware	≤ 5.21	Yes
Hardware	zyxel	atp100	-	No
Operating System	zyxel	atp100w_firmware	≤ 5.21	Yes
Hardware	zyxel	atp100w	-	No
Operating System	zyxel	atp200_firmware	≤ 5.21	Yes
Hardware	zyxel	atp200	-	No
Operating System	zyxel	atp500_firmware	≤ 5.21	Yes
Hardware	zyxel	atp500	-	No
Operating System	zyxel	atp700_firmware	≤ 5.21	Yes
Hardware	zyxel	atp700	-	No
Operating System	zyxel	atp800_firmware	≤ 5.21	Yes
Hardware	zyxel	atp800	-	No
Operating System	zyxel	usg_110_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_110	-	No
Operating System	zyxel	usg_1100_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_1100	-	No
Operating System	zyxel	usg_1900_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_1900	-	No
Operating System	zyxel	usg_20w_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_20w	-	No
Operating System	zyxel	usg_20w-vpn_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_20w-vpn	-	No
Operating System	zyxel	usg_2200-vpn_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_2200-vpn	-	No
Operating System	zyxel	usg_310_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_310	-	No
Operating System	zyxel	usg_40_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_40	-	No
Operating System	zyxel	usg_40w_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_40w	-	No
Operating System	zyxel	usg_60_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_60	-	No
Operating System	zyxel	usg_60w_firmware	≤ 4.71	Yes
Hardware	zyxel	usg_60w	-	No
Operating System	zyxel	usg_flex_100_firmware	≤ 5.21	Yes
Hardware	zyxel	usg_flex_100	-	No
Operating System	zyxel	usg_flex_100w_firmware	≤ 5.21	Yes
Hardware	zyxel	usg_flex_100w	-	No
Operating System	zyxel	usg_flex_200_firmware	≤ 5.21	Yes
Hardware	zyxel	usg_flex_200	-	No
Operating System	zyxel	usg_flex_500_firmware	≤ 5.21	Yes
Hardware	zyxel	usg_flex_500	-	No
Operating System	zyxel	usg_flex_700_firmware	≤ 5.21	Yes
Hardware	zyxel	usg_flex_700	-	No
Operating System	zyxel	usg200_firmware	≤ 4.71	Yes
Hardware	zyxel	usg200	-	No
Operating System	zyxel	usg20_firmware	≤ 4.71	Yes
Hardware	zyxel	usg20	-	No
Operating System	zyxel	usg210_firmware	≤ 4.71	Yes
Hardware	zyxel	usg210	-	No
Operating System	zyxel	usg2200_firmware	≤ 4.71	Yes
Hardware	zyxel	usg2200	-	No
Operating System	zyxel	usg300_firmware	≤ 4.71	Yes
Hardware	zyxel	usg300	-	No
Operating System	zyxel	usg310_firmware	≤ 4.71	Yes
Hardware	zyxel	usg310	-	No
Operating System	zyxel	nsg300_firmware	< 1.33	Yes
Operating System	zyxel	nsg300_firmware	1.33	Yes
Operating System	zyxel	nsg300_firmware	1.33	Yes
Operating System	zyxel	nsg300_firmware	1.33	Yes
Operating System	zyxel	nsg300_firmware	1.33	Yes
Operating System	zyxel	nsg300_firmware	1.33	Yes
Hardware	zyxel	nsg300	-	No
Operating System	zyxel	nsg100_firmware	< 1.33	Yes
Operating System	zyxel	nsg100_firmware	1.33	Yes
Operating System	zyxel	nsg100_firmware	1.33	Yes
Operating System	zyxel	nsg100_firmware	1.33	Yes
Operating System	zyxel	nsg100_firmware	1.33	Yes
Operating System	zyxel	nsg100_firmware	1.33	Yes
Hardware	zyxel	nsg100	-	No
Operating System	zyxel	nsg50_firmware	< 1.33	Yes
Operating System	zyxel	nsg50_firmware	1.33	Yes
Operating System	zyxel	nsg50_firmware	1.33	Yes
Operating System	zyxel	nsg50_firmware	1.33	Yes
Operating System	zyxel	nsg50_firmware	1.33	Yes
Operating System	zyxel	nsg50_firmware	1.33	Yes
Hardware	zyxel	nsg50	-	No
Operating System	zyxel	nxc2500_firmware	≤ 6.10\(aaig.3\)	Yes
Hardware	zyxel	nxc2500	-	No
Operating System	zyxel	nxc5500_firmware	≤ 6.10\(aaos.3\)	Yes
Hardware	zyxel	nxc5500	-	No
Operating System	zyxel	nap203_firmware	≤ 6.25\(abfa.7\)	Yes
Hardware	zyxel	nap203	-	No
Operating System	zyxel	nap303_firmware	≤ 6.25\(abex.7\)	Yes
Hardware	zyxel	nap303	-	No
Operating System	zyxel	nap353_firmware	≤ 6.25\(abey.7\)	Yes
Hardware	zyxel	nap353	-	No
Operating System	zyxel	nwa50ax_firmware	≤ 6.25\(abyw.5\)	Yes
Hardware	zyxel	nwa50ax	-	No
Operating System	zyxel	nwa55axe_firmware	≤ 6.25\(abzl.5\)	Yes
Hardware	zyxel	nwa55axe	-	No
Operating System	zyxel	nwa90ax_firmware	≤ 6.27\(accv.2\)	Yes
Hardware	zyxel	nwa90ax	-	No
Operating System	zyxel	nwa110ax_firmware	≤ 6.30\(abtg.2\)	Yes
Hardware	zyxel	nwa110ax	-	No
Operating System	zyxel	nwa210ax_firmware	≤ 6.30\(abtd.2\)	Yes
Hardware	zyxel	nwa210ax	-	No
Operating System	zyxel	nwa1123-ac-hd_firmware	≤ 6.25\(abin.6\)	Yes
Hardware	zyxel	nwa1123-ac-hd	-	No
Operating System	zyxel	nwa1123-ac-pro_firmware	≤ 6.25\(abhd.7\)	Yes
Hardware	zyxel	nwa1123-ac-pro	-	No
Operating System	zyxel	nwa1123acv3_firmware	≤ 6.30\(abvt.2\)	Yes
Hardware	zyxel	nwa1123acv3	-	No
Operating System	zyxel	nwa1302-ac_firmware	≤ 6.25\(abku.6\)	Yes
Hardware	zyxel	nwa1302-ac	-	No
Operating System	zyxel	nwa5123-ac-hd_firmware	≤ 6.25\(abim.6\)	Yes
Hardware	zyxel	nwa5123-ac-hd	-	No
Operating System	zyxel	wac500h_firmware	≤ 6.30\(abwa.2\)	Yes
Hardware	zyxel	wac500h	-	No
Operating System	zyxel	wac500_firmware	≤ 6.30\(abvs.2\)	Yes
Hardware	zyxel	wac500	-	No
Operating System	zyxel	wac5302d-s_firmware	≤ 6.10\(abfh.10\)	Yes
Hardware	zyxel	wac5302d-s	-	No
Operating System	zyxel	wac5302d-sv2_firmware	≤ 6.25\(abvz.6\)	Yes
Hardware	zyxel	wac5302d-sv2	-	No
Operating System	zyxel	wac6103d-i_firmware	≤ 6.25\(aaxh.7\)	Yes
Hardware	zyxel	wac6103d-i	-	No
Operating System	zyxel	wac6303d-s_firmware	≤ 6.25\(abgl.6\)	Yes
Hardware	zyxel	wac6303d-s	-	No
Operating System	zyxel	wac6502d-e_firmware	≤ 6.25\(aasd.7\)	Yes
Hardware	zyxel	wac6502d-e	-	No
Operating System	zyxel	wac6502d-s_firmware	≤ 6.25\(aase.7\)	Yes
Hardware	zyxel	wac6502d-s	-	No
Operating System	zyxel	wac6503d-s_firmware	≤ 6.25\(aasf.7\)	Yes
Hardware	zyxel	wac6503d-s	-	No
Operating System	zyxel	wac6553d-s_firmware	≤ 6.25\(aasg.7\)	Yes
Hardware	zyxel	wac6553d-s	-	No
Operating System	zyxel	wac6552d-s_firmware	≤ 6.25\(abio.7\)	Yes
Hardware	zyxel	wac6552d-s	-	No
Operating System	zyxel	wax510d_firmware	≤ 6.30\(abtf.2\)	Yes
Hardware	zyxel	wax510d	-	No
Operating System	zyxel	wax610d_firmware	≤ 6.30\(abte.2\)	Yes
Hardware	zyxel	wax610d	-	No
Operating System	zyxel	wax630s_firmware	≤ 6.30\(abzd.2\)	Yes
Hardware	zyxel	wax630s	-	No
Operating System	zyxel	wax650s_firmware	≤ 6.30\(abrm.2\)	Yes
Hardware	zyxel	wax650s	-	No

References

http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html ([email protected])
http://seclists.org/fulldisclosure/2022/Jun/15 ([email protected])
https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml Vendor Advisory ([email protected])
http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2022/Jun/15 (af854a3a-2127-422b-91ae-364da2661108)
https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For zyxel's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.