CVE-2022-30525: Zyxel Firewall - OS Command Injection

HoneyLabs honeypots recorded 34 probes matching CVE-2022-30525 from 2 distinct source IP addresses in the last 7 days, of which 6 on interactive sensors. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2022-05-16.

One source probed for CVE-2022-30525 on the interactive sensors. It did not send the exploit payload.

What the sensors show

Probes arrived on 4 of the 7 days in this window. The busiest day was 2026-11-08, with 14. One address, 195.178.110.78, sent 94% of them. The largest source network was AS48090 (Techoff Srv Limited), with 94% of the probes from 1 address. It is still being probed 4 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 45 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i140900_cbb2034c60b8_e7c285222651.

Request paths that identify it

• /ztp/cgi-bin/handler

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /ztp/cgi-bin/handler

Requests the interactive sensors answered

• POST /ztp/cgi-bin/handler

HTTP client fingerprints

• b11cuq060_00050815_30319a11
• b11cuq060_00050813_95cc9d02