CVE-2022-38547

A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.

Score

CVSS 3.1 7.2 High

Status

Modified - security@zyxel.com.tw

Published

2023-02-07

Last modified

2025-03-25

Weaknesses

CWE-78

Affected products

• Atp100 Firmware (Zyxel)
• Atp100w Firmware (Zyxel)
• Atp200 Firmware (Zyxel)
• Atp500 Firmware (Zyxel)
• Atp700 Firmware (Zyxel)
• Atp800 Firmware (Zyxel)
• Atp Series Firmware (Zyxel)
• Usg20-vpn Firmware (Zyxel)
• Usg20w-vpn Firmware (Zyxel)
• Usg40 Firmware (Zyxel)
• Usg40w Firmware (Zyxel)
• Usg60 Firmware (Zyxel)
• Usg60w Firmware (Zyxel)
• Usg Flex 100 Firmware (Zyxel)
• Usg Flex 100w Firmware (Zyxel)
• Usg Flex 200 Firmware (Zyxel)
• Usg Flex 500 Firmware (Zyxel)
• Usg Flex 50 Firmware (Zyxel)
• Usg Flex 700 Firmware (Zyxel)
• Usg Flex Series Firmware (Zyxel)
• Vpn1000 Firmware (Zyxel)
• Vpn100 Firmware (Zyxel)
• Vpn300 Firmware (Zyxel)
• Vpn50 Firmware (Zyxel)
• Vpn Series Firmware (Zyxel)
• Zywall 1100 Firmware (Zyxel)
• Zywall 110 Firmware (Zyxel)
• Zywall 310 Firmware (Zyxel)
• Zywallusg Series Firmware (Zyxel)

References

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-fire…