Zyxel Firewall ZTP Unauthenticated Command Injection
- Product
- Zyxel USG FLEX / ATP / USG20-VPN firewalls
- CVE
- CVE-2022-30525
- Disclosed
- 2022-05-12
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- USG FLEX 100/100W/200/500/700 ZLD5.00-ZLD5.21 Patch 1; USG20-VPN/USG20W-VPN and ATP series ZLD5.10-ZLD5.21 Patch 1.
- Fixed
- ZLD5.30.
Summary
Rapid7 found an unauthenticated command injection in Zyxel firewalls' zero-touch provisioning handler. Zyxel patched silently in April 2022; after disclosure, exploitation and Mirai-variant botnets followed quickly.
Root cause
The ZTP CGI handler accepts a JSON request to configure WAN ports and passes a field value into a shell command built with os.system-like calls without sanitization. The endpoint requires no authentication, so commands run as the nobody user.
Impact
Unauthenticated command execution on the firewall.
Detection
Look for POSTs to /ztp/cgi-bin/handler with setWanPortSt and shell metacharacters. Nuclei template CVE-2022-30525.
Mitigation
Upgrade to ZLD5.30 and disable WAN administration.