The flaw, tracked as CVE-2022-30525, affects ATP, VPN and USG FLEX series firewalls. The vulnerability can be exploited by a remote, unauthenticated attacker for arbitrary code execution as the “nobody” user.

The affected products are recommended for businesses and they provide VPN, SSL inspection, intrusion protection, web filtering and email security capabilities. The Shodan search engine shows more than 15,000 potentially affected devices that are exposed to the internet.

The vulnerability found by Rapid7 has been described as an unauthenticated command injection issue that can be exploited through a device’s HTTP interface. The company has explained how an attacker could exploit the weakness to obtain a reverse shell.