The vulnerability of microprogrammed network device software from Zyxel models USG FLEX 100(W), USG FLEX 200, USG FLEX 500, USG FLEX 700, USG FLEX 50(W), USG20(W)-VPN, ATP, VPN, USG/ZyWALL arises due to incorrect path name restrictions in the access-controlled catalog. This allows attackers to disclose sensitive information.

🗓️ 31 Aug 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Zyxel devices have a vulnerability from path name restrictions enabling data disclosure.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-2030	19 Jul 202206:15	–	attackerkb
Circl	CVE-2022-2030	19 Jul 202212:40	–	circl
CNNVD	Zyxel USG FLEX 路径遍历漏洞	19 Jul 202200:00	–	cnnvd
CVE	CVE-2022-2030	19 Jul 202205:55	–	cve
Cvelist	CVE-2022-2030	19 Jul 202205:55	–	cvelist
EUVD	EUVD-2022-34334	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Zyxel products	20 Jul 202200:00	–	ncsc
NVD	CVE-2022-2030	19 Jul 202206:15	–	nvd
OSV	CVE-2022-2030	19 Jul 202206:15	–	osv
Prion	Directory traversal	19 Jul 202206:15	–	prion

Vulners

Node

zyxel_communications atpRange4.32–5.21

OR

zyxel_communications usg_flex_50(w)Range4.16–5.31

OR

zyxel_communications usg_flex_200Range4.50–5.31

OR

zyxel_communications usg_flex_500Range4.50–5.31

OR

zyxel_communications usg_flex_700Range4.50–5.31

OR

zyxel_communications usg_flex_100wRange<5.31

OR

zyxel_communications usg_20(w)-vpnRange4.20–5.31

OR

zyxel_communications usg_flex_50(w)Range4.20–5.31

OR

zyxel_communications zywallRange4.20–4.72

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-2030
zyxel	www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
web	www.web.nvd.nist.gov/view/vuln/detail

31 Aug 2022 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 36.5

CVSS 26.8

EPSS0.01262

Zyxel devices path name restrictions data disclosure ZyWALL devices Flex models restricted directory