CVE-2022-26531

Published: May 24, 2022Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

Affected (80)

Products: Zyxel: Vpn100 Firmware, Vpn1000 Firmware, Vpn300 Firmware, Vpn50 Firmware, Atp100 Firmware, Atp100w Firmware, Atp200 Firmware, Atp500 Firmware, Atp700 Firmware, Atp800 Firmware, Usg 110 Firmware, Usg 1100 Firmware, Usg 1900 Firmware, Usg 20w Firmware, Usg 20w Vpn Firmware, Usg 2200 Vpn Firmware, Usg 310 Firmware, Usg 40 Firmware, Usg 40w Firmware, Usg 60 Firmware, Usg 60w Firmware, Usg Flex 100 Firmware, Usg Flex 100w Firmware, Usg Flex 200 Firmware, Usg Flex 500 Firmware, Usg Flex 700 Firmware, Usg200 Firmware, Usg20 Firmware, Usg210 Firmware, Usg2200 Firmware, Usg300 Firmware, Usg310 Firmware, Nsg300 Firmware, Nsg100 Firmware, Nsg50 Firmware, Nxc2500 Firmware, Nxc5500 Firmware, Nap203 Firmware, Nap303 Firmware, Nap353 Firmware, Nwa50ax Firmware, Nwa55axe Firmware, Nwa90ax Firmware, Nwa110ax Firmware, Nwa210ax Firmware, Nwa1123 Ac Hd Firmware, Nwa1123 Ac Pro Firmware, Nwa1123acv3 Firmware, Nwa1302 Ac Firmware, Nwa5123 Ac Hd Firmware, Wac500h Firmware, Wac500 Firmware, Wac5302d S Firmware, Wac5302d Sv2 Firmware, Wac6103d I Firmware, Wac6303d S Firmware, Wac6502d E Firmware, Wac6502d S Firmware, Wac6503d S Firmware, Wac6553d S Firmware, Wac6552d S Firmware, Wax510d Firmware, Wax610d Firmware, Wax630s Firmware, Wax650s Firmware

65 products

Usg 2200 Vpn Firmware

Usg Flex 100 Firmware

Usg Flex 100w Firmware

Usg Flex 200 Firmware

Usg Flex 500 Firmware

Usg Flex 700 Firmware

Nwa1123 Ac Hd Firmware

Nwa1123 Ac Pro Firmware

Nwa1123acv3 Firmware

Nwa1302 Ac Firmware

Nwa5123 Ac Hd Firmware

Wac500h Firmware

Wac500 Firmware

Wac5302d S Firmware

Wac5302d Sv2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn100 Firmware	From 4.30 to 5.21

Running on/with	Platform Versions
Zyxel Vpn100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn1000 Firmware	From 4.30 to 5.21

Running on/with	Platform Versions
Zyxel Vpn1000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn300 Firmware	From 4.30 to 5.21

Running on/with	Platform Versions
Zyxel Vpn300	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Vpn50 Firmware	From 4.30 to 5.21

Running on/with	Platform Versions
Zyxel Vpn50	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp100 Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp100	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp100w Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp100w	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp200 Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp200	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp500 Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp500	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp700 Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp700	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Atp800 Firmware	From 4.32 to 5.21

Running on/with	Platform Versions
Zyxel Atp800	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 110 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 110	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 1100 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 1100	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 1900 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 1900	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 20w Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 20w	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 20w Vpn Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 20w Vpn	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 2200 Vpn Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 2200 Vpn	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 310 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 310	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 40 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 40	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 40w Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 40w	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 60 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 60	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg 60w Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg 60w	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 100 Firmware	From 4.50 to 5.21

Running on/with	Platform Versions
Zyxel Usg Flex 100	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 100w Firmware	From 4.50 to 5.21

Running on/with	Platform Versions
Zyxel Usg Flex 100w	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 200 Firmware	From 4.50 to 5.21

Running on/with	Platform Versions
Zyxel Usg Flex 200	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 500 Firmware	From 4.50 to 5.21

Running on/with	Platform Versions
Zyxel Usg Flex 500	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg Flex 700 Firmware	From 4.50 to 5.21

Running on/with	Platform Versions
Zyxel Usg Flex 700	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg200 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg200	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg20 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg20	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg210 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg210	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg2200 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg2200	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg300 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg300	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Usg310 Firmware	From 4.09 to 4.71

Running on/with	Platform Versions
Zyxel Usg310	All versions

Configuration G

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nsg300 Firmware	From 1.00 to 1.33
Zyxel Nsg300 Firmware	Version 1.33
Zyxel Nsg300 Firmware	Version 1.33 patch1
Zyxel Nsg300 Firmware	Version 1.33 patch2
Zyxel Nsg300 Firmware	Version 1.33 patch3
Zyxel Nsg300 Firmware	Version 1.33 patch4

Running on/with	Platform Versions
Zyxel Nsg300	All versions

Configuration H

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nsg100 Firmware	From 1.00 to 1.33
Zyxel Nsg100 Firmware	Version 1.33
Zyxel Nsg100 Firmware	Version 1.33 patch1
Zyxel Nsg100 Firmware	Version 1.33 patch2
Zyxel Nsg100 Firmware	Version 1.33 patch3
Zyxel Nsg100 Firmware	Version 1.33 patch4

Running on/with	Platform Versions
Zyxel Nsg100	All versions

Configuration I

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nsg50 Firmware	From 1.00 to 1.33
Zyxel Nsg50 Firmware	Version 1.33
Zyxel Nsg50 Firmware	Version 1.33 patch1
Zyxel Nsg50 Firmware	Version 1.33 patch2
Zyxel Nsg50 Firmware	Version 1.33 patch3
Zyxel Nsg50 Firmware	Version 1.33 patch4

Running on/with	Platform Versions
Zyxel Nsg50	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nxc2500 Firmware	Up to 6.10\(aaig.3\)

Running on/with	Platform Versions
Zyxel Nxc2500	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nxc5500 Firmware	Up to 6.10\(aaos.3\)

Running on/with	Platform Versions
Zyxel Nxc5500	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nap203 Firmware	Up to 6.25\(abfa.7\)

Running on/with	Platform Versions
Zyxel Nap203	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nap303 Firmware	Up to 6.25\(abex.7\)

Running on/with	Platform Versions
Zyxel Nap303	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nap353 Firmware	Up to 6.25\(abey.7\)

Running on/with	Platform Versions
Zyxel Nap353	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa50ax Firmware	Up to 6.25\(abyw.5\)

Running on/with	Platform Versions
Zyxel Nwa50ax	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa55axe Firmware	Up to 6.25\(abzl.5\)

Running on/with	Platform Versions
Zyxel Nwa55axe	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa90ax Firmware	Up to 6.27\(accv.2\)

Running on/with	Platform Versions
Zyxel Nwa90ax	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa110ax Firmware	Up to 6.30\(abtg.2\)

Running on/with	Platform Versions
Zyxel Nwa110ax	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa210ax Firmware	Up to 6.30\(abtd.2\)

Running on/with	Platform Versions
Zyxel Nwa210ax	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa1123 Ac Hd Firmware	Up to 6.25\(abin.6\)

Running on/with	Platform Versions
Zyxel Nwa1123 Ac Hd	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa1123 Ac Pro Firmware	Up to 6.25\(abhd.7\)

Running on/with	Platform Versions
Zyxel Nwa1123 Ac Pro	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa1123acv3 Firmware	Up to 6.30\(abvt.2\)

Running on/with	Platform Versions
Zyxel Nwa1123acv3	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa1302 Ac Firmware	Up to 6.25\(abku.6\)

Running on/with	Platform Versions
Zyxel Nwa1302 Ac	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nwa5123 Ac Hd Firmware	Up to 6.25\(abim.6\)

Running on/with	Platform Versions
Zyxel Nwa5123 Ac Hd	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac500h Firmware	Up to 6.30\(abwa.2\)

Running on/with	Platform Versions
Zyxel Wac500h	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac500 Firmware	Up to 6.30\(abvs.2\)

Running on/with	Platform Versions
Zyxel Wac500	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac5302d S Firmware	Up to 6.10\(abfh.10\)

Running on/with	Platform Versions
Zyxel Wac5302d S	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac5302d Sv2 Firmware	Up to 6.25\(abvz.6\)

Running on/with	Platform Versions
Zyxel Wac5302d Sv2	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6103d I Firmware	Up to 6.25\(aaxh.7\)

Running on/with	Platform Versions
Zyxel Wac6103d I	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6303d S Firmware	Up to 6.25\(abgl.6\)

Running on/with	Platform Versions
Zyxel Wac6303d S	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6502d E Firmware	Up to 6.25\(aasd.7\)

Running on/with	Platform Versions
Zyxel Wac6502d E	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6502d S Firmware	Up to 6.25\(aase.7\)

Running on/with	Platform Versions
Zyxel Wac6502d S	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6503d S Firmware	Up to 6.25\(aasf.7\)

Running on/with	Platform Versions
Zyxel Wac6503d S	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6553d S Firmware	Up to 6.25\(aasg.7\)

Running on/with	Platform Versions
Zyxel Wac6553d S	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wac6552d S Firmware	Up to 6.25\(abio.7\)

Running on/with	Platform Versions
Zyxel Wac6552d S	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wax510d Firmware	Up to 6.30\(abtf.2\)

Running on/with	Platform Versions
Zyxel Wax510d	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wax610d Firmware	Up to 6.30\(abte.2\)

Running on/with	Platform Versions
Zyxel Wax610d	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wax630s Firmware	Up to 6.30\(abzd.2\)

Running on/with	Platform Versions
Zyxel Wax630s	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Wax650s Firmware	Up to 6.30\(abrm.2\)

Running on/with	Platform Versions
Zyxel Wax650s	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html

Source: security@zyxel.com.tw

http://packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html

Source: security@zyxel.com.tw

http://seclists.org/fulldisclosure/2022/Jun/15

Source: security@zyxel.com.tw

https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml

Source: security@zyxel.com.tw

Vendor Advisory

http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2022/Jun/15

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.