CVE-2022-26531

🗓️ 24 May 2022 00:00:00Reported by ZyxelType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 112 Views🌐 WEB

CVE-2022-26531: Multiple input validation flaws in Zyxel firmwar

Reporter	Title	Published	Views	Family All 17
zdt	Zyxel zysh - Format string Exploit	11 Feb 202400:00	–	zdt
ATTACKERKB	CVE-2022-26531	24 May 202206:15	–	attackerkb
BDU FSTEC	The vulnerability of the command-line interface (CLI) of Zyxel network device software allows a hacker to trigger a service failure.	22 Aug 202200:00	–	bdu_fstec
Circl	CVE-2022-26531	24 May 202212:41	–	circl
CNNVD	Zyxel USG/ZyWALL 输入验证错误漏洞	24 May 202200:00	–	cnnvd
Cvelist	CVE-2022-26531	24 May 202200:00	–	cvelist
Exploit DB	Zyxel zysh - Format string	9 Feb 202400:00	–	exploitdb
EUVD	EUVD-2022-31088	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Zyxel products	25 May 202200:00	–	ncsc
NVD	CVE-2022-26531	24 May 202206:15	–	nvd

NVD

Node

AND

zyxel vpn100_firmwareRange4.30–5.21

zyxel vpn100Match-

Node

AND

zyxel vpn1000_firmwareRange4.30–5.21

zyxel vpn1000Match-

Node

AND

zyxel vpn300_firmwareRange4.30–5.21

zyxel vpn300Match-

Node

AND

zyxel vpn50_firmwareRange4.30–5.21

zyxel vpn50Match-

Node

AND

zyxel atp100_firmwareRange4.32–5.21

zyxel atp100Match-

Node

AND

zyxel atp100w_firmwareRange4.32–5.21

zyxel atp100wMatch-

Node

AND

zyxel atp200_firmwareRange4.32–5.21

zyxel atp200Match-

Node

AND

zyxel atp500_firmwareRange4.32–5.21

zyxel atp500Match-

Node

AND

zyxel atp700_firmwareRange4.32–5.21

zyxel atp700Match-

Node

AND

zyxel atp800_firmwareRange4.32–5.21

zyxel atp800Match-

Node

AND

zyxel usg_110_firmwareRange4.09–4.71

zyxel usg_110Match-

Node

AND

zyxel usg_1100_firmwareRange4.09–4.71

zyxel usg_1100Match-

Node

AND

zyxel usg_1900_firmwareRange4.09–4.71

zyxel usg_1900Match-

Node

AND

zyxel usg_20w_firmwareRange4.09–4.71

zyxel usg_20wMatch-

Node

AND

zyxel usg_20w-vpn_firmwareRange4.09–4.71

zyxel usg_20w-vpnMatch-

Node

AND

zyxel usg_2200-vpn_firmwareRange4.09–4.71

zyxel usg_2200-vpnMatch-

Node

AND

zyxel usg_310_firmwareRange4.09–4.71

zyxel usg_310Match-

Node

AND

zyxel usg_40_firmwareRange4.09–4.71

zyxel usg_40Match-

Node

AND

zyxel usg_40w_firmwareRange4.09–4.71

zyxel usg_40wMatch-

Node

AND

zyxel usg_60_firmwareRange4.09–4.71

zyxel usg_60Match-

Node

AND

zyxel usg_60w_firmwareRange4.09–4.71

zyxel usg_60wMatch-

Node

AND

zyxel usg_flex_100_firmwareRange4.50–5.21

zyxel usg_flex_100Match-

Node

AND

zyxel usg_flex_100w_firmwareRange4.50–5.21

zyxel usg_flex_100wMatch-

Node

AND

zyxel usg_flex_200_firmwareRange4.50–5.21

zyxel usg_flex_200Match-

Node

AND

zyxel usg_flex_500_firmwareRange4.50–5.21

zyxel usg_flex_500Match-

Node

AND

zyxel usg_flex_700_firmwareRange4.50–5.21

zyxel usg_flex_700Match-

Node

AND

zyxel usg200_firmwareRange4.09–4.71

zyxel usg200Match-

Node

AND

zyxel usg20_firmwareRange4.09–4.71

zyxel usg20Match-

Node

AND

zyxel usg210_firmwareRange4.09–4.71

zyxel usg210Match-

Node

AND

zyxel usg2200_firmwareRange4.09–4.71

zyxel usg2200Match-

Node

AND

zyxel usg300_firmwareRange4.09–4.71

zyxel usg300Match-

Node

AND

zyxel usg310_firmwareRange4.09–4.71

zyxel usg310Match-

Node

AND

zyxel nsg300_firmwareRange1.00–1.33

zyxel nsg300_firmwareMatch1.33-

zyxel nsg300_firmwareMatch1.33patch1

zyxel nsg300_firmwareMatch1.33patch2

zyxel nsg300_firmwareMatch1.33patch3

zyxel nsg300_firmwareMatch1.33patch4

zyxel nsg300Match-

Node

AND

zyxel nsg100_firmwareRange1.00–1.33

zyxel nsg100_firmwareMatch1.33-

zyxel nsg100_firmwareMatch1.33patch1

zyxel nsg100_firmwareMatch1.33patch2

zyxel nsg100_firmwareMatch1.33patch3

zyxel nsg100_firmwareMatch1.33patch4

zyxel nsg100Match-

Node

AND

zyxel nsg50_firmwareRange1.00–1.33

zyxel nsg50_firmwareMatch1.33-

zyxel nsg50_firmwareMatch1.33patch1

zyxel nsg50_firmwareMatch1.33patch2

zyxel nsg50_firmwareMatch1.33patch3

zyxel nsg50_firmwareMatch1.33patch4

zyxel nsg50Match-

Node

AND

zyxel nxc2500_firmwareRange≤6.10(aaig.3)

zyxel nxc2500Match-

Node

AND

zyxel nxc5500_firmwareRange≤6.10(aaos.3)

zyxel nxc5500Match-

Node

AND

zyxel nap203_firmwareRange≤6.25(abfa.7)

zyxel nap203Match-

Node

AND

zyxel nap303_firmwareRange≤6.25(abex.7)

zyxel nap303Match-

Node

AND

zyxel nap353_firmwareRange≤6.25(abey.7)

zyxel nap353Match-

Node

AND

zyxel nwa50ax_firmwareRange≤6.25(abyw.5)

zyxel nwa50axMatch-

Node

AND

zyxel nwa55axe_firmwareRange≤6.25(abzl.5)

zyxel nwa55axeMatch-

Node

AND

zyxel nwa90ax_firmwareRange≤6.27(accv.2)

zyxel nwa90axMatch-

Node

AND

zyxel nwa110ax_firmwareRange≤6.30(abtg.2)

zyxel nwa110axMatch-

Node

AND

zyxel nwa210ax_firmwareRange≤6.30(abtd.2)

zyxel nwa210axMatch-

Node

AND

zyxel nwa1123-ac-hd_firmwareRange≤6.25(abin.6)

zyxel nwa1123-ac-hdMatch-

Node

AND

zyxel nwa1123-ac-pro_firmwareRange≤6.25(abhd.7)

zyxel nwa1123-ac-proMatch-

Node

AND

zyxel nwa1123acv3_firmwareRange≤6.30(abvt.2)

zyxel nwa1123acv3Match-

Node

AND

zyxel nwa1302-ac_firmwareRange≤6.25(abku.6)

zyxel nwa1302-acMatch-

Node

AND

zyxel nwa5123-ac-hd_firmwareRange≤6.25(abim.6)

zyxel nwa5123-ac-hdMatch-

Node

AND

zyxel wac500h_firmwareRange≤6.30(abwa.2)

zyxel wac500hMatch-

Node

AND

zyxel wac500_firmwareRange≤6.30(abvs.2)

zyxel wac500Match-

Node

AND

zyxel wac5302d-s_firmwareRange≤6.10(abfh.10)

zyxel wac5302d-sMatch-

Node

AND

zyxel wac5302d-sv2_firmwareRange≤6.25(abvz.6)

zyxel wac5302d-sv2Match-

Node

AND

zyxel wac6103d-i_firmwareRange≤6.25(aaxh.7)

zyxel wac6103d-iMatch-

Node

AND

zyxel wac6303d-s_firmwareRange≤6.25(abgl.6)

zyxel wac6303d-sMatch-

Node

AND

zyxel wac6502d-e_firmwareRange≤6.25(aasd.7)

zyxel wac6502d-eMatch-

Node

AND

zyxel wac6502d-s_firmwareRange≤6.25(aase.7)

zyxel wac6502d-sMatch-

Node

AND

zyxel wac6503d-s_firmwareRange≤6.25(aasf.7)

zyxel wac6503d-sMatch-

Node

AND

zyxel wac6553d-s_firmwareRange≤6.25(aasg.7)

zyxel wac6553d-sMatch-

Node

AND

zyxel wac6552d-s_firmwareRange≤6.25(abio.7)

zyxel wac6552d-sMatch-

Node

AND

zyxel wax510d_firmwareRange≤6.30(abtf.2)

zyxel wax510dMatch-

Node

AND

zyxel wax610d_firmwareRange≤6.30(abte.2)

zyxel wax610dMatch-

Node

AND

zyxel wax630s_firmwareRange≤6.30(abzd.2)

zyxel wax630sMatch-

Node

AND

zyxel wax650s_firmwareRange≤6.30(abrm.2)

zyxel wax650sMatch-

[
  {
    "vendor": "Zyxel",
    "product": "USG/ZyWALL series firmware",
    "versions": [
      {
        "version": "4.09 through 4.71",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "USG FLEX series firmware",
    "versions": [
      {
        "version": "4.50 through 5.21",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "ATP series firmware",
    "versions": [
      {
        "version": "4.32 through 5.21",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "VPN series firmware",
    "versions": [
      {
        "version": "4.30 through 5.21",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "NSG series firmware",
    "versions": [
      {
        "version": "1.00 through 1.33 Patch 4",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "NXC2500 firmware",
    "versions": [
      {
        "version": "<= 6.10(AAIG.3)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "NAP203 firmware",
    "versions": [
      {
        "version": "<= 6.25(ABFA.7)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "NWA50AX firmware",
    "versions": [
      {
        "version": "<= 6.25(ABYW.5)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "WAC500 firmware",
    "versions": [
      {
        "version": "<= 6.30(ABVS.2)",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Zyxel",
    "product": "WAX510D firmware",
    "versions": [
      {
        "version": "<= 6.30(ABTF.2)",
        "status": "affected"
      }
    ]
  }
]

Source	Link
zyxel	www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml
seclists	www.seclists.org/fulldisclosure/2022/Jun/15
packetstormsecurity	www.packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html
packetstormsecurity	www.packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html

Parameter	Position	Path	Description	CWE
extension	path	webconsole/	Format string vulnerability in zysh extension argument (used by various commands like ping) that can crash or be exploited to execute code; PoC demonstrates extension-based format string bugs via the ping command.	CWE-20
test_name	path	webconsole/	Format string vulnerability in zysh extension argument (used by various commands like ping) that can crash or be exploited to execute code; PoC demonstrates extension-based format string bugs via the ping command.	CWE-20
test_num	path	webconsole/	Format string vulnerability in zysh extension argument (used by various commands like ping) that can crash or be exploited to execute code; PoC demonstrates extension-based format string bugs via the ping command.	CWE-20

17 Jun 2026 04:35Current

7.8High risk

Vulners AI Score7.8

CVSS 24.6

CVSS 3.16.1 - 7.8

EPSS0.05673

CWE-20