Critical 9.8Known exploited (CISA KEV)Published May 12, 2022

CVE-2022-30525A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 fi…

Updated under an hour ago (Oct 27, 2026, 10:10 AM ET)

Does this affect you?

It affects Zyxel USG FLEX 100(W) firmware and 20 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 16, 2022; federal agencies had to remediate by Jun 6, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Zyxel USG FLEX 100(W) firmware

Exploited in the last 30 days

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV May 16, 2022; federal remediation due Jun 6, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.94% (percentile 100)
Assigned by: Zyxel
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Zyxel USG FLEX 100(W) firmware zyxel:usg_flex_100_w_firmware (from the name)	5.00 through 5.21 Patch 1	CNA record
Zyxel USG FLEX 200 firmware zyxel:usg_flex_200_firmware (from the name)	5.00 through 5.21 Patch 1	CNA record
Zyxel USG FLEX 500 firmware zyxel:usg_flex_500_firmware (from the name)	5.00 through 5.21 Patch 1	CNA record
Zyxel USG FLEX 700 firmware zyxel:usg_flex_700_firmware (from the name)	5.00 through 5.21 Patch 1	CNA record
Zyxel ATP series firmware zyxel:atp_series_firmware (from the name)	5.10 through 5.21 Patch 1	CNA record
Zyxel VPN series firmware zyxel:vpn_series_firmware (from the name)	4.60 through 5.21 Patch 1	CNA record
Zyxel USG FLEX 50(W) firmware zyxel:usg_flex_50_w_firmware (from the name)	5.10 through 5.21 Patch 1	CNA record
Zyxel USG 20(W)-VPN firmware zyxel:usg_20_w_vpn_firmware (from the name)	5.10 through 5.21 Patch 1	CNA record
zyxel usg_flex_100w_firmware zyxel:usg_flex_100w_firmware	from 5.00 before 5.30	NVD
zyxel usg_flex_200_firmware zyxel:usg_flex_200_firmware	from 5.00 before 5.30	NVD
1–10 of 24

References

References

https://www.zyxel.com/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml	x-refsource-confirm, vendor-advisory
http://packetstormsecurity.com/files/167176/Zyxel-Remote-Command-Execution.html	x-refsource-misc, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/167182/Zyxel-Firewall-ZTP-Unauthenticated-Command-Injection.html	x-refsource-misc, exploit, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/167372/Zyxel-USG-FLEX-5.21-Command-Injection.html	x-refsource-misc, exploit, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/168202/Zyxel-Firewall-SUID-Binary-Privilege-Escalation.html	x-refsource-misc, exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30525	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.