CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

Proself, a self-hosted groupware/webmail product line from Japan's North Grid, improperly restricts XML external entity references (CWE-611) when processing XML data submitted to the server. A remote, unauthenticated attacker can send a specially crafted request containing malformed XML that triggers XXE resolution, allowing the attacker to read arbitrary files on the server, including files containing account information. Successful exploitation therefore primarily threatens confidentiality — exposed account credentials and sensitive data on the server — with no impact on integrity or availability per the CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N). Organizations running Proself Enterprise/Standard Edition 5.62 or earlier, Gateway Edition 1.65 or earlier, or Mail Sanitize Edition 1.08 or earlier are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-12-03, confirming exploitation in the wild, and EPSS estimates a 3.5% probability of exploitation in the next 30 days (89th percentile); no public PoC is known.

Do: Upgrade all Proself editions to fixed releases per North Grid's guidance — beyond Ver5.62 for Enterprise/Standard, beyond Ver1.65 for Gateway, and beyond Ver1.08 for Mail Sanitize — or discontinue use of the product if mitigations are unavailable, per CISA's required action. Prioritize internet-facing Proself instances, review web/application logs for suspicious XML-containing requests, and rotate exposed account credentials since account information files are the primary target of this file-read flaw.

CVE-2024-11667 is a directory traversal vulnerability (CWE-22) in the web management interface of several Zyxel firewall lines, allowing an unauthenticated remote attacker to download or upload files via a crafted URL. It is triggered over the network with no privileges or user interaction required, earning a critical CVSS 3.1 score of 9.8. Successful exploitation can expose sensitive files on the device and support broader intrusions, and CISA notes the flaw is being used in ransomware campaigns. Organizations running Zyxel ATP or USG FLEX firewalls on firmware V5.00–V5.38, or USG FLEX 50(W)/USG20(W)-VPN firewalls on V5.10–V5.38, are affected, particularly where the management interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03 with known ransomware use; no public proof-of-concept is known.

Do: Upgrade affected ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firewalls to a fixed firmware release per Zyxel's security advisory (any version above the affected V5.00–V5.38 / V5.10–V5.38 ranges); per CISA's KEV required action, apply the vendor's mitigations or discontinue use if mitigations are unavailable. Until patched, restrict or disable WAN-side HTTP/HTTPS management access to these devices and prioritize internet-exposed units. Given known ransomware use, hunt for signs of compromise on exposed devices, including unexpected uploaded files or anomalous administrative traffic.

ProjectSend versions prior to r1720 fail to enforce authentication on requests to options.php (CWE-306, missing authentication for a critical function), a critical flaw rated CVSS 9.8. A remote, unauthenticated attacker can send crafted HTTP requests directly to options.php to modify the application's configuration without any user interaction. With configuration control, the attacker can enable registration and create accounts, upload webshells to achieve code execution on the server, and embed malicious JavaScript in the site. Any organization running ProjectSend earlier than r1720 — especially internet-facing deployments used for client file exchange — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03, carries a 91.7% EPSS probability of exploitation within 30 days, and public reporting and a Metasploit module are available.

Do: Upgrade ProjectSend to r1720 or later, which restores proper authentication on options.php; per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigation is not possible. Prioritize internet-facing instances and hunt for signs of compromise, including unexpected or new user accounts, modified configuration, unexpected PHP files or webshells on the server, and injected JavaScript. Until patched, restrict network access to the installation and limit or protect access to options.php.

Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an attacker with the guest account of the affected products accesses a specific file, the information containing credentials may be obtained.

UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands.

CyberPanel versions through 2.3.6, and 2.3.7 before commit 1c0c6cb, contain an OS command injection flaw (CWE-78) in the getresetstatus functions of dns/views.py and ftp/views.py. Because the security middleware (secMiddleware) only enforces authentication on POST requests, a remote unauthenticated attacker can send a GET request to /dns/getresetstatus or /ftp/getresetstatus and inject shell metacharacters into the statusfile parameter, executing arbitrary commands as the service. Successful exploitation yields full command execution on the hosting server with high impact to confidentiality, integrity, and availability (CVSS 9.8). Any internet-exposed CyberPanel instance, commonly used by web hosts to manage DNS and FTP services, is affected. The flaw was mass-exploited in the wild in October 2024 by the PSAUX ransomware group against roughly 22,000 CyberPanel instances, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-12-04 with ransomware use confirmed.

Do: Upgrade CyberPanel to a build that includes commit 1c0c6cb or later (2.3.7 alone is unpatched), per vendor instructions, or discontinue/restrict use of the product per CISA's KEV required action. Check web access logs for GET requests to /dns/getresetstatus and /ftp/getresetstatus from unauthenticated sources and review servers for PSAUX ransomware indicators. If immediate patching is not possible, restrict panel endpoints to trusted networks and block unauthenticated GET access to the affected routes.

Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered.