Zyxel firewalls CVE-2022-30525 (unauthenticated OS command injection in the CGI program of USG FLEX, ATP and VPN series, CISA KEV): which firmware fixes it?

What it is: CVE-2022-30525, reported by Rapid7 and disclosed in May 2022, is an OS command injection flaw in a CGI program on several Zyxel firewall models. An unauthenticated attacker who can reach the device's web interface can run commands on it. Exploitation began within days of disclosure (it was used to recruit devices into botnets), and CISA added it to the KEV catalog. Small-business firewalls like these are often left unpatched for years. Am I affected (per Zyxel's advisory): - USG FLEX 100(W), 200, 500, 700 on ZLD V5.00 through V5.21 Patch 1. - USG FLEX 50(W) and USG20(W)-VPN on ZLD V5.10 through V5.21 Patch 1. - ATP series on ZLD V5.10 through V5.21 Patch 1. - VPN series on ZLD V4.60 through V5.21 Patch 1. - Check the firmware version on the device dashboard. Models or versions outside these ranges, or past Zyxel's support period, aren't covered by the advisory. Fix: 1. Upgrade to ZLD V5.30 or later (today, the latest firmware for your model). Zyxel calls the patch the best protection. 2. Don't expose the web management interface to the WAN; restrict it to the LAN or a management VPN, and disable unused remote services. 3. If an affected device was reachable from the internet before patching, check it for unknown admin accounts, configuration changes, scheduled jobs and unexpected outbound traffic; reset it to factory defaults and restore a known-good configuration if in doubt, and change admin and VPN credentials. Verify: the dashboard shows ZLD V5.30+ (or current firmware), and from outside your network the management interface is not reachable. Sources: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-of-firewalls https://nvd.nist.gov/vuln/detail/CVE-2022-30525 https://www.cisa.gov/known-exploited-vulnerabilities-catalog