CVE-2022-2030 : A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identi

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.

Published 2022-07-19 06:15:08

Updated 2022-07-29 22:00:12

Source Zyxel Corporation

View at NVD, CVE.org

Vulnerability category: Directory traversal

Exploit prediction scoring system (EPSS) score for CVE-2022-2030

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-2030

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	Zyxel Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-2030

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by:

nvd@nist.gov (Primary)
security@zyxel.com.tw (Secondary)

References for CVE-2022-2030

Products affected by CVE-2022-2030

Zyxel » Zywall 110 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:zywall_110_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall 110 » Version: N/A
Zyxel » Zywall 1100 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:zywall_1100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall 1100 » Version: N/A
Zyxel » Zywall 310 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:zywall_310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Zywall 310 » Version: N/A
Zyxel » Usg 2200-vpn Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_2200-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg 2200-vpn » Version: N/A
Zyxel » Atp200 Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp200 » Version: N/A
Zyxel » Atp500 Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp500 » Version: N/A
Zyxel » Atp800 Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp800 » Version: N/A
Zyxel » Usg20-vpn Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg20-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20-vpn » Version: N/A
Zyxel » Usg20w-vpn Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg20w-vpn » Version: N/A
Zyxel » Usg40 Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 4.72
cpe:2.3:o:zyxel:usg40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg40 » Version: N/A
Zyxel » Usg40w Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 4.72
cpe:2.3:o:zyxel:usg40w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg40w » Version: N/A
Zyxel » Usg60 Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 4.72
cpe:2.3:o:zyxel:usg60_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg60 » Version: N/A
Zyxel » Usg60w Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 4.72
cpe:2.3:o:zyxel:usg60w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg60w » Version: N/A
Zyxel » Vpn50 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:vpn50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Vpn50 » Version: N/A
Zyxel » Vpn100 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:vpn100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Vpn100 » Version: N/A
Zyxel » Vpn300 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:vpn300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Vpn300 » Version: N/A
Zyxel » Atp100 Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100 » Version: N/A
Zyxel » Vpn1000 Firmware
Versions from including (>=) 4.30 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:vpn1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Vpn1000 » Version: N/A
Zyxel » Usg Flex 200 Firmware
Versions from including (>=) 4.50 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 200 » Version: N/A
Zyxel » Usg Flex 500 Firmware
Versions from including (>=) 4.50 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 500 » Version: N/A
Zyxel » Usg Flex 100w Firmware
Versions from including (>=) 4.50 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 100w » Version: N/A
Zyxel » Usg Flex 700 Firmware
Versions from including (>=) 4.50 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 700 » Version: N/A
Zyxel » Atp100w Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp100w » Version: N/A
Zyxel » Atp700 Firmware
Versions from including (>=) 4.32 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Atp700 » Version: N/A
Zyxel » Usg Flex 50w Firmware
Versions from including (>=) 4.20 and up to, including, (<=) 5.30
cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Zyxel » Usg Flex 50w » Version: N/A

Vulnerability Details : CVE-2022-2030

Exploit prediction scoring system (EPSS) score for CVE-2022-2030

CVSS scores for CVE-2022-2030

CWE ids for CVE-2022-2030

References for CVE-2022-2030

Products affected by CVE-2022-2030