CVE-2022-2030: Path Traversal

Q: What is CVE-2022-2030?

CVE-2022-2030 is a directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL in Zyxel USG FLEX and other affected firmware versions.

Q: How severe is CVE-2022-2030?

CVE-2022-2030 has a severity value of 6.5, which is considered medium severity.

Q: How can I fix CVE-2022-2030?

To fix CVE-2022-2030, it is recommended to update your affected Zyxel USG FLEX firmware versions to 5.40 or higher.

Q: Where can I find more information about CVE-2022-2030?

You can find more information about CVE-2022-2030 in the Zyxel security advisory on their official website.

Published Jul 19, 2022

Updated

A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.11 through 4.72, that could allow an authenticated attacker to access some restricted files on a vulnerable device.

Affected Software

50 affected components

Zyxel Usg Flex 100w Firmware>=4.50<=5.30

Zyxel Usg Flex 100w

Zyxel USG FLEX 200 firmware>=4.50<=5.30

Zyxel USG FLEX 200

Zyxel USG FLEX 500 firmware>=4.50<=5.30

Zyxel USG FLEX 500

Zyxel USG FLEX 700 firmware>=4.50<=5.30

Zyxel USG FLEX 700

Zyxel Usg Flex 50w Firmware>=4.20<=5.30

Zyxel Usg Flex 50w

Zyxel Usg20w-vpn Firmware>=4.20<=5.30

Zyxel USG20W-VPN

Zyxel Atp800 Firmware>=4.32<=5.30

Zyxel ATP800

Zyxel Atp700 Firmware>=4.32<=5.30

Zyxel Atp700

Zyxel Atp500 Firmware>=4.32<=5.30

Zyxel ATP500

Zyxel Atp200 Firmware>=4.32<=5.30

Zyxel ATP200

Zyxel Atp100w Firmware>=4.32<=5.30

Zyxel Atp100w

Zyxel Atp100 Firmware>=4.32<=5.30

Zyxel Atp100

Zyxel Vpn1000 Firmware>=4.30<=5.30

Zyxel Vpn1000

Zyxel Vpn300 Firmware>=4.30<=5.30

Zyxel Vpn300

Zyxel Vpn100 Firmware>=4.30<=5.30

Zyxel Vpn100

Zyxel Vpn50 Firmware>=4.30<=5.30

Zyxel Vpn50

Zyxel Usg20-vpn Firmware>=4.30<=5.30

Zyxel USG20-VPN

Zyxel Usg 2200-vpn Firmware>=4.30<=5.30

Zyxel Usg 2200-vpn

Zyxel Zywall 110 Firmware>=4.30<=5.30

Zyxel ZyWALL 110

Zyxel Zywall 310 Firmware>=4.30<=5.30

Zyxel ZyWALL 310

Zyxel Zywall 1100 Firmware>=4.30<=5.30

Zyxel ZyWALL 1100

Zyxel Usg40 Firmware>=4.20<=4.72

Zyxel USG40

Zyxel Usg40w Firmware>=4.20<=4.72

Zyxel USG40W

Zyxel Usg60 Firmware>=4.20<=4.72

Zyxel USG60

Zyxel Usg60w Firmware>=4.20<=4.72

Zyxel USG60W

Event History

Jul 19, 2022

CVE Published

via MITRE·05:55 AM

Data Sourced

via MITRE·05:55 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-2030?

CVE-2022-2030 is a directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL in Zyxel USG FLEX and other affected firmware versions.

How severe is CVE-2022-2030?

CVE-2022-2030 has a severity value of 6.5, which is considered medium severity.

Which software versions are affected by CVE-2022-2030?

Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, and USG FLEX 500 firmware versions 4.50 through 5.30 are affected by CVE-2022-2030.

How can I fix CVE-2022-2030?

To fix CVE-2022-2030, it is recommended to update your affected Zyxel USG FLEX firmware versions to 5.40 or higher.

Where can I find more information about CVE-2022-2030?