CVE-2022-30525

What it actually does

This vulnerability is an unauthenticated, network-reachable OS command injection flaw in the Zyxel ZLD CGI/ZTP handler used by affected USG FLEX, ATP, VPN, and USG20(W)-VPN firewall firmware. A crafted request to the vulnerable CGI program can cause attacker-controlled input to be interpreted by the underlying operating system, allowing commands to run with the privileges of the device web management process. Successful exploitation can modify device files, execute arbitrary commands, install tooling, alter firewall/VPN configuration, create persistence, capture traffic, and use the appliance as a foothold into protected networks.

Why it matters to the business

Compromise of an edge firewall or VPN appliance can expose internal networks, disrupt internet connectivity, weaken security policy enforcement, and allow attackers to intercept or redirect traffic. The vulnerability has a critical CVSS score, an extremely high EPSS likelihood, and is listed in CISA KEV with a remediation deadline of 2022-06-06, indicating broad, real-world exploitation risk and a long history of active scanning. Because these devices often sit at the network perimeter, unpatched systems should be treated as high-priority exposure even if no ransomware use is currently identified.

How an attack unfolds

An attacker first identifies an internet-accessible Zyxel firewall or VPN appliance running an affected firmware version. They then send a crafted HTTP request to the vulnerable ZTP CGI endpoint, commonly associated with /ztp/cgi-bin/handler and the setWanPortSt command path. Malicious shell metacharacters embedded in request parameters are interpreted by the appliance operating system rather than handled as data. This allows the attacker to run commands such as downloading payloads, opening a reverse shell, modifying configuration files, or staging malware in temporary directories. After gaining command execution, the attacker may enumerate configuration, harvest VPN or administrator credentials, change firewall rules, implant persistence, join the device to a botnet, proxy additional attacks through the appliance, or pivot toward internal systems reachable from the firewall.

How to fix it

Upgrade affected Zyxel USG FLEX, ATP, VPN, and USG20(W)-VPN devices to vendor-fixed firmware immediately. For the firmware ranges listed as vulnerable, upgrade to Zyxel ZLD 5.30 or later where available, or to the latest vendor-supported firmware for the exact model. If immediate upgrade is not possible, remove management and ZTP interfaces from internet exposure, restrict access to trusted administrative IP addresses through upstream controls, disable unused remote management features, and monitor the device closely until it can be patched. Because this vulnerability is actively exploited and has been public for years, any previously exposed unpatched appliance should be assessed for compromise; where compromise is suspected, back up necessary configuration, perform a clean firmware reinstall or factory reset, reapply known-good configuration, rotate administrator passwords, rotate VPN credentials and certificates as appropriate, and review firewall/NAT/VPN policy for unauthorized changes.

How to confirm the fix worked

Confirm the exact model and firmware version from the Zyxel management interface or CLI and verify it is no longer within the vulnerable ranges: USG FLEX 100(W), 200, 500, and 700 firmware 5.00 through 5.21 Patch 1; USG FLEX 50(W), USG20(W)-VPN, and ATP series firmware 5.10 through 5.21 Patch 1; and VPN series firmware 4.60 through 5.21 Patch 1. Validate that the device reports a fixed release such as ZLD 5.30 or later, or the latest vendor-supported firmware for that model. From an external network, confirm that web management and ZTP endpoints are not publicly reachable unless explicitly required and access-controlled. Review vulnerability scanner results and external attack surface inventory for exposed Zyxel management services. For a non-invasive check, look for access to /ztp/cgi-bin/handler and confirm the device no longer accepts unauthenticated CGI/ZTP requests. After remediation, review configuration backups and running policy to ensure no unauthorized accounts, routes, NAT rules, VPN users, or firewall rules remain.

Typical attack path

1. Scan the internet for exposed Zyxel USG FLEX, ATP, VPN, or USG20(W)-VPN appliances with reachable web/ZTP management services.
2. Fingerprint the device model and firmware family through banners, TLS certificates, login pages, or known Zyxel web paths.
3. Send a crafted unauthenticated POST request to the vulnerable CGI/ZTP handler endpoint.
4. Inject shell metacharacters into a vulnerable parameter so the appliance executes attacker-controlled OS commands.
5. Use command execution to fetch or stage payloads, test outbound connectivity, or establish an interactive reverse shell.
6. Modify files or configuration to maintain access, weaken firewall policy, or conceal activity.
7. Harvest configuration data, credentials, VPN material, routing information, or internal network details.
8. Use the compromised perimeter device for botnet activity, traffic proxying, internal reconnaissance, or follow-on intrusion.

How to detect it

Investigate whether the appliance received suspicious HTTP requests to the Zyxel ZTP CGI endpoint, especially POST requests to /ztp/cgi-bin/handler containing setWanPortSt or parameters with shell metacharacters such as semicolons, pipes, backticks, command substitution, or encoded equivalents. Useful data sources include device web access logs if retained, upstream reverse proxy or WAF logs, perimeter firewall logs, NetFlow, DNS logs, NDR packet captures, and any centralized syslog from the appliance. Because many appliances have limited local logging, network telemetry is often the most reliable source. Look for the firewall appliance initiating unexpected outbound HTTP, HTTPS, FTP, TFTP, DNS, or raw TCP connections shortly after inbound management requests, especially to unfamiliar IP addresses or newly observed domains. Investigate evidence of command execution or payload staging, including use of curl, wget, tftp, busybox, nc/netcat, chmod, sh, or files written under temporary directories. Review device configuration and backups for unexpected administrator accounts, VPN users, firewall/NAT rules, DNS settings, static routes, startup commands, modified WAN settings, or unexplained configuration timestamps. If threat hunting covers endpoint/network process telemetry for appliances, look for the web management process spawning shell interpreters or download utilities. Treat any successful exploit indicators as potential full device compromise and expand investigation to internal systems reachable from the appliance.

• /ztp/cgi-bin/handler
• POST /ztp/cgi-bin/handler
• "command":"setWanPortSt"
• "command": "setWanPortSt"
• setWanPortSt
• "mtu":";
• "mtu": ";
• "mtu":"|
• "mtu": "|
• "mtu":"`
• "mtu": "`
• "mtu":"$(
• "mtu": "$(
• %3Bcurl
• %3Bwget
• %7Ccurl
• %7Cwget
• curl http
• wget http
• tftp -g
• busybox wget
• /tmp/
• /var/tmp/
• chmod +x
• /bin/sh
• sh -c
• zhttpd
• zysh

What your security team should do

• Immediately inventory all Zyxel USG FLEX, ATP, VPN, and USG20(W)-VPN appliances, including spares and branch devices, and identify any running affected firmware.
• Patch or replace vulnerable appliances as an emergency perimeter-risk item; the CISA KEV remediation deadline has long passed and exploitation is active in the wild.
• Remove internet exposure for administrative, web management, and ZTP services wherever possible; enforce trusted-source access and MFA for management access when supported.
• Assume exposed unpatched devices may have been probed or compromised; perform forensic review before considering patching alone sufficient.
• Search historical web, reverse proxy, firewall, NetFlow, DNS, and EDR/NDR telemetry for exploitation patterns targeting /ztp/cgi-bin/handler and suspicious outbound connections from the appliance.
• Review device configuration for unauthorized administrator accounts, VPN users, firewall rules, NAT rules, DNS changes, routes, startup scripts, scheduled tasks, or unexpected files in temporary directories.
• Rotate local administrator credentials, VPN pre-shared keys, API credentials, and certificates if exploitation is suspected or if the device was internet-exposed while vulnerable.
• Where compromise is likely, rebuild from trusted firmware and known-good configuration rather than relying only on in-place cleanup.
• Add SIEM detections for POST requests to the vulnerable CGI handler, command-injection metacharacters in Zyxel management requests, and perimeter appliances initiating unexpected outbound downloads or shell connections.
• Continuously monitor vendor advisories for Zyxel firmware updates and ensure perimeter appliances are included in routine vulnerability management SLAs.