CVE:CVE-2022-2030
CNNVD:CNNVD-202207-1613
Zyxel USG FLEX是中国合勤科技（Zyxel）公司的一款防火墙。提供灵活的 VPN 选项（IPsec、SSL 或 L2TP），为远程工作和管理提供灵活的安全远程访问。
Zyxel产品存在安全漏洞，该漏洞源于一些CGI程序中发现了由未适当处理URL中的特定字符序列引起的目录穿越漏洞，这可能允许经过身份验证的攻击者访问受攻击设备上的一些受限文件。以下产品及版本受到影响：Zyxel USG FLEX 100(W)固件版本4.50至5.30、USG FLEX 200固件版本4.50至5.30、USG FLEX 500固件版本4.50至5.30、USG FLEX 700固件版本4.50至5.30、USG FLEX 50(W)固件版本4.16至5.30、USG20(W)-VPN固件版本4.16至5.30、ATP系列固件版本4.32至5.30、VPN系列固件版本4.30至5.30、USG/ZyWALL系列固件版本4.11至4.72。
solution:Upgrade zyxel usg_flex_100w_firmware to a higher version than 5.30,and avoid the version [4.50,5.30]; Upgrade zyxel usg_flex_200_firmware to a higher version than 5.30,and avoid the version [4.50,5.30]; Upgrade zyxel usg_flex_500_firmware to a higher version than 5.30,and avoid the version [4.50,5.30]; Upgrade zyxel usg_flex_700_firmware to a higher version than 5.30,and avoid the version [4.50,5.30]; Upgrade zyxel usg_flex_50w_firmware to a higher version than 5.30,and avoid the version [4.20,5.30]; Upgrade zyxel usg20w-vpn_firmware to a higher version than 5.30,and avoid the version [4.20,5.30]; Upgrade zyxel atp800_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel atp700_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel atp500_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel atp200_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel atp100w_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel atp100_firmware to a higher version than 5.30,and avoid the version [4.32,5.30]; Upgrade zyxel vpn1000_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel vpn300_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel vpn100_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel vpn50_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel usg20-vpn_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel usg_2200-vpn_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel zywall_110_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel zywall_310_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel zywall_1100_firmware to a higher version than 5.30,and avoid the version [4.30,5.30]; Upgrade zyxel usg40_firmware to a higher version than 4.72,and avoid the version [4.20,4.72]; Upgrade zyxel usg40w_firmware to a higher version than 4.72,and avoid the version [4.20,4.72]; Upgrade zyxel usg60_firmware to a higher version than 4.72,and avoid the version [4.20,4.72]; Upgrade zyxel usg60w_firmware to a higher version than 4.72,and avoid the version [4.20,4.72]