A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FL…

published 2022-07-19 4y ago modified 2026-06-17 4mo ago also EUVD-2022-52386

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 1; Metasploit

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

Is CVE-2022-30526 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2022-06-14 First public exploit (Metasploit exploit/linux/local/zyxel_suid_cp_lpe)
2022-07-19 Published

Exploit prediction

1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/local/zyxel_suid_cp_lpe Zyxel Firewall SUID Binary Privilege Escalation metasploit exploit, excellent rank, 2022-06-14
packetstormsecurity.com http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Zyxel USG FLEX 100(W) firmware
Zyxel USG FLEX 200 firmware
Zyxel USG FLEX 500 firmware
Zyxel USG FLEX 700 firmware
Zyxel ATP series firmware
Zyxel VPN series firmware
Zyxel USG FLEX 50(W) firmware
Zyxel USG 20(W)-VPN firmware
Zyxel USG/ZyWALL series firmware

Classification

Weakness

CWE-269 Improper Privilege Management

References

packetstormsecurity.com /files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html
exploit, third-party-advisory, vdb-entry
zyxel.com /support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
vendor-advisory

Sources

CVE List CVE-2022-30526
NVD CVE-2022-30526

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed