Researchers warn of hackers widely exploiting bug in Zyxel hardware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-28771 | Unauthenticated OS Command Injection in Zyxel ATP, USG FLEX, VPN, and ZyWALL Firewalls CVE-2023-28771 is an unauthenticated OS command injection flaw (CWE-78) in Zyxel firewall firmware, caused by improper error message handling in the IKE packet decoder. A remote attacker triggers it by sending crafted packets to an affected device, with no credentials or user interaction required (CVSS 3.1: 9.8, network vector, low complexity). Successful exploitation lets the attacker execute operating-system commands on the firewall, which typically means full device compromise of these perimeter/VPN gateway appliances. Organizations running Zyxel ZyWALL/USG, VPN, USG FLEX, or ATP series firewalls on the affected firmware ranges are exposed, especially where IKE/VPN traffic is reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-05-31, carries a 99.3% EPSS score (100th percentile), is reportedly used by DDoS botnets, and was reportedly exploited in the May 2023 coordinated attacks against nearly two dozen Danish energy companies. Do: Apply Zyxel's patched firmware to all affected devices per the vendor advisory - releases newer than 4.73 for ZyWALL/USG and newer than 5.35 for ATP, USG FLEX, and VPN series - prioritizing internet-facing and VPN gateway appliances, as this is a KEV required-action vulnerability. Where immediate patching is not possible, restrict IKE traffic (UDP 500/4500) to trusted peers or disable unneeded IPsec VPN termination. After patching, review device logs and configurations for signs of command execution or unexpected changes, given confirmed botnet and targeted-attack use. | 9.8 | 99% | KEV PoC |
| largetens of thousands of internet-exposed Zyxel firewall/VPN gateways (order of 10,000-100,000 devices/sites); estimate | |
| CVE-2023-33010 +1 in the same advisory: …33009 | Buffer Overflow in Zyxel ATP, USG FLEX, VPN and ZyWALL/USG Firewalls Enables RCE CVE-2023-33010 is a buffer overflow (CWE-120) in the ID processing function of Zyxel's firewall firmware that is triggered when an affected device processes crafted input sent by an unauthenticated attacker. Successful exploitation can cause denial-of-service conditions and, more seriously, allow remote code execution on the firewall itself, giving an attacker a foothold at the network perimeter. The flaw affects multiple Zyxel firewall lines widely used by small and mid-sized organizations, including ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and legacy ZyWALL/USG models. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2023-06-05), indicating it is being exploited in the wild, though no public proof-of-concept is known and ransomware association is unconfirmed. EPSS puts the 30-day exploitation probability at 28.8% (98th percentile), and no CVSS score has been published yet. Do: Apply the updated firmware for your specific model per Zyxel's security advisory, since the CISA required action is to patch per vendor instructions. Until patched, restrict or disable WAN-side access to the firewall's management/ID processing interfaces and monitor devices for signs of compromise such as unexpected reboots or crashes. Inventory all ATP, USG FLEX (including 50(W)), USG20(W)-VPN, VPN, and ZyWALL/USG units to confirm none remain unpatched. | 9.8 | 29% | KEV |
| large≈tens of thousands of internet-exposed devices from a combined installed base likely well over 100,000 across these firewall lines |
Full article466 words · extracted from therecord.media · click to collapse
A critical vulnerability affecting Zyxel firewalls is being widely exploited by hackers, according to a report published this week by cybersecurity firm Rapid7. The vulnerability, tracked as CVE-2023-28771, is exploitable in the wide area network (WAN) interface, a port on a device that connects it to the internet. WAN interfaces are commonly found on devices such as routers, switches, and network appliances. It’s the latest in a series of bugs found in products from Taiwan-based Zyxel, which sells networking hardware and other services, typically to small- and medium-sized organizations. According to Rapid7, the current vulnerability exists in the default configuration of exploitable devices, and a device does not need to have a VPN configuration to be vulnerable. Successful exploitation of the bug allows hackers to execute malicious code remotely on the target system to install malware. As of the end of May, the Zyxel vulnerability had been widely used to compromise devices to carry out further attacks through a version of the notorious Mirai botnet, according to Rapid7. Mirai is commonly used to launch distributed denial of service (DDoS) attacks, but is capable of other tasks, too. Zyxel released patches for CVE-2023-28771 in April and urges users to install them for protection. On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also published an alert warning that the Zyxel vulnerability is being actively exploited by attackers, urging federal agencies to apply the available update by June this year. “These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the agency said. Zyxel has recently fixed two other critical severity flaws, CVE-2023-33009 and CVE-2023-33010, which impact the same firewall and VPN products. These vulnerabilities allow hackers to either cause a denial-of-service situation or run any code they want on the devices that are affected, according to Rapid7. The company drew attention for another bug about a year ago. Attacks against firewall devices are common. They have been carried out by both cyber-espionage and financially motivated groups. Vendors that had enterprise firewalls abused this way recently include Pulse Secure, Palo Alto Network, Fortinet, Citrix and Cisco. In March, for example, a suspected state-sponsored hacking group based in China exploited zero-day vulnerabilities in Fortinet firewalls and deployed custom malware to spy on defense, government, tech and telecom organizations. In April, tech giant Cisco warned about attacks on routers allegedly being exploited by Russian military hackers.
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/zyxel-wan-vpn-vulnerability-may-2023