FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

Exploit
CVE-2022-26532

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: May 24, 2022 / Updated: 30mo ago

010
CVSS 7.8EPSS 0.05%High
CVE info copied to clipboard

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2022-26532. See article

May 24, 2022 at 5:23 AM / cve.report
Threat Intelligence Report

CVE-2022-26532 is a critical OS command injection vulnerability with a CVSS score of 7.8. Zyxel assigned this CVE along with CVE-2022-26531 on March 17, 2022. It is currently unclear if this vulnerability is being actively exploited in the wild, and there may be proof-of-concept exploits available. Organizations should implement mitigations and monitor for patches to protect against potential downstream impacts to other third-party vendors or technologies. See article

Jun 20, 2022 at 6:15 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 17.5%)

Sep 15, 2023 at 9:03 AM
Static CVE Timeline Graph

Affected Systems

Zyxel/usg_1900_firmware
+null more

Exploits

http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for multiple vulnerabilities of firewalls, AP controllers, and APs
30mo
Multiple improper input validation flaws were identified in some CLI commands of some firewall, AP controller, and AP versions that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload. A command injection vulnerability in the "packet-trace" CLI command of some firewall, AP controller, and AP versions could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the command.
Zyxel Buffer Overflow / Format String / Command Injection
Vulnerabilities Database - CXSecurity.com / 29mo
string bugs and the command injection vulnerability are exploitable by The zysh binary is a restricted shell that implements the command-line
Daily Vulnerability Trends: Thu Jun 09 2022
RedPacket Security / 29mo
CVE-2022-30190 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. CVE-2022-26937 Windows Network File System Remote Code Execution Vulnerability.
See 1 more references

News

Update Mon Feb 19 02:07:13 UTC 2024
Recent Commits to cve:main / 9mo
Update Mon Feb 19 02:07:13 UTC 2024
Big update to my Semgrep C/C++ ruleset - hn security
r/netsec / 11mo
Coming back to our static analysis methodology, here’s a simplified outline that can be used to quickly audit a large codebase with the help of Semgrep: Read the documentation, especially about past vulnerabilities, to uncover attack surface and interesting paths. My Semgrep ruleset (as well as some other tools I’ve released in the past) should help with the bottom-up approach, by isolating hotspots in code where bugs are likely to manifest.
Zyxel nsa320 firmware. inc /inc/js_product_services. Wireless Reviews...
Google Alert - "service passengers" OR "truck excels" OR firewall OR "drivers routes" OR "guides truck" OR "navigator gps" OR "fota secure" OR "innovative firmware" OR "driver hacker" OR "operate chargers" OR "vehicle connectivity" OR "navigation automated" OR tomtom OR firmware OR "navigation software" OR "various charging" OR "smartphone car" OR "rate passengers" OR "car connectivity" OR "truck navigation" OR "database truck" OR "ridership including" OR "chargers circuit" OR "driver comprehensive" OR "inform passengers" OR "bookings efficient" OR gps OR "passengers trips" OR "electrical charger" OR timetables OR "updates car" OR "automotive security" OR encryption OR "truck routing" OR "truck navigator" OR "fota software" OR outlet OR navigator OR "hardware security" OR "secure software" OR guides / 26mo
Click this to upload the new firmware To acquire firmware, software, FAQ, product application or other support files for Zyxel devices, enter the model number in the search box. A couple of suggestions, if this is an empty 3-TB drive, you could install that, let the box do its thing and allocate as much as it likes, upgrade the firmware Redirects for Download Library | Zyxel Networks My research has pointed me towards the D-Link DNS-320 or the ZyXEL NSA320.
Security update live blog – WeTransfer abused, Linux malware lurking | #linux | #linuxsecurity
NATIONAL CYBER SECURITY NEWS TODAY / 26mo
Refresh 2022-09-13T15:24:53.003Z (Image credit: Shutterstock) New Linux malware found targeting endpoints of all types A brand new malware, targeting Linux devices, was recently discovered. Dubbed Shikitega, by researchers from AT&T Alien Labs that first discovered it, the malware can do all sorts of things, from controlling the webcam on the... The post Security update live blog – WeTransfer abused, Linux malware lurking #linux #linuxsecurity appeared first on NATIONAL CYBER SECURITY NEWS TODAY .
Zyxel Updates NAS Devices to Fix Potential Security Flaw
CySecurity News - Latest Information Security and Hacking Incidents / 26mo
CVE-2022-26532: Certain firewall, AP controller, and AP versions contain the 'packet-trace' CLI command that contains a command injection vulnerability that might allow a local, authorized attacker to execute arbitrary OS instructions by providing specially crafted inputs to the function. This revelation follows Zyxel's July patching of the CVE-2022-30526 and CVE-2022-2030 vulnerabilities impacting its firewall products, which affect local root access and authenticated directory traverse.
See 73 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 7.8(51562)CWE-78(3977)CWE-88(244)Zyxel(259)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial