Command injection

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100W firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1,...

CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection

Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...

CVE-2022-30525

CVE-2022-30525 is an OS command injection in Zyxel firewall CGI (Zero Touch Provisioning) that allows remote, unauthenticated code execution via /ztp/cgi-bin/handler (nobody user). Affected: USG FLEX series (5.00–5.21 Patch 1), USG FLEX 50W/USG20(W)-VPN (5.10–5.21 Patch 1), ATP series (5.10–5.21 ...

CVE-2022-30525

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100W firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1,...

CVE-2022-30525

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100W firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1,...

合勤科技 USG FLEX 操作系统命令注入漏洞

Zyxel USG FLEX is a firewall from China-based Hopkins Technology Zyxel. It provides flexible VPN options IPsec, SSL, or L2TP to provide flexible and secure remote access for remote work and management. A security vulnerability exists in Zyxel USG FLEX versions 5.00 through 5.21. An attacker could...

Zyxel Firewall ZTP Unauthenticated Command Injection

This module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning ZTP support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler page, an...

CVE-2022-0342

CVE-2022-0342 describes an authentication bypass in Zyxel CGI web interfaces across multiple product lines (USG/ZyWALL, USG FLEX, ATP, VPN, NSG) with firmware ranges 4.20–4.70, 4.50–5.20, 4.32–5.20, 4.30–5.20, and 1.20–1.33 Patch 4. The flaw allows bypassing web authentication to obtain administr...

Information Leakage Vulnerability in Qixing Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product officially launched by Qixing. There is an information leakage vulnerability in Qishen Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...

CVE-2021-22356

CVE-2021-22356 affects Huawei security devices and modules, including IPS Module V500R005C00SPC100/SPC200, NGFW Module V500R005C00SPC100/SPC200, Secospace USG6300/USG6500/USG6600, and USG9500. The vulnerability stems from use of a weak secure algorithm in a module that can be exploited by capturi...

Logic Flaw Vulnerability in Qixing Tian Please Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a logic flaw vulnerability in Qixing Tian please Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...

CVE-2021-35029

An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected devi...

CVE-2021-35029

The CVE-2021-35029 entry describes an authentication bypass in the web-based management interface of Zyxel devices (USG/Zywall series firmware 4.35–4.64 and USG Flex/ATP/VPN series firmware 4.35–5.01) that could allow a remote attacker to execute arbitrary commands on an affected device. The conn...

Command Execution Vulnerability in Tianqing Hanma USG Firewall (CNVD-2021-41975)

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a command execution vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain server control privileges...

Command Execution Vulnerability in Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a command execution vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain server control privileges...

CVE-2020-9213

There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft many specific packets. Successful exploit may cause some services to be abnormal. Affected products include some versions of NGFW Module,...

Weak password vulnerability in Qixing Tianqing Hanma USG Firewall (CNVD-2021-24737)

Tianqing HANMAR USG Firewall is developed based on Qixing ISE unified engine, there is no OEM from third-party functions, and the functions can be split in any combination, which has very little impact on the system performance. There is a weak password vulnerability in Qisda Tianqing Hanma USG...

Weak Password Vulnerability in Huawei's USG Firewall

Huawei USG Firewall is a firewall from Huawei for small businesses, branch offices, sales outlets, community service stations, and other scenarios. Huawei USG Firewall suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

Logic Flaw Vulnerability in Qixing Tianqing Hanma USG Firewall

Tianqing Hanma USG Firewall is developed based on Qixing ISE unified engine, there is no OEM from third-party functions, and the functions can be split in any combination, which has very little impact on system performance. Adopting multi-core hardware architecture and integrated software design,...

Weak Password Vulnerability in Tianqing Hanma USG Firewall of Beijing Qixing Information Security Technology Co.

Tianqing Hanma USG Firewall is a new firewall series product launched by Qixing. There is a weak password vulnerability in Tianqing Hanma USG Firewall, which can be exploited by attackers to obtain sensitive information...