Zyxel Flaw Powers New Mirai IoT Botnet Strain
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-9054 | Pre-Authentication OS Command Injection in Zyxel NAS Devices CVE-2020-9054 is a pre-authentication OS command injection flaw (CWE-78) in multiple Zyxel network-attached storage (NAS) devices. A remote, unauthenticated attacker can send crafted input to the devices' web interface to inject and execute arbitrary OS commands without logging in, resulting in remote code execution on the NAS. Successful exploitation gives the attacker control of the device, which can be used to access, alter or destroy stored data and to pivot into the network the NAS is attached to. Organizations and users running affected Zyxel NAS models are at risk, especially where the management web interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, confirming exploitation in the wild; EPSS assigns a 100% probability of exploitation within 30 days, while no public proof-of-concept is known and any ransomware use is unconfirmed. Do: Apply the firmware updates specified in Zyxel's advisory, per CISA's required action, prioritizing any NAS whose web interface is exposed to the internet. Until patched, restrict the NAS management interface to trusted networks or VPN access and do not expose the admin UI directly to the internet. Because exploitation is confirmed in the wild, check affected devices for indicators of compromise, such as unexpected accounts, scheduled jobs, or outbound connections. | 9.8 | 100% | KEV PoC |
| moderateplausibly tens of thousands of affected devices installed worldwide, with only a low-thousands subset directly internet-exposed |
Full article367 words · extracted from krebsonsecurity.com · click to collapse
In February, hardware maker Zyxel fixed a zero-day vulnerability in its routers and VPN firewall products after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of Mirai, a malware strain that targets vulnerable Internet of Things (IoT) devices for use in large-scale attacks and as proxies for other cybercrime activity.
Security experts at Palo Alto Networks said Thursday their sensors detected the new Mirai variant — dubbed Mukashi — on Mar. 12. The new Mirai strain targets CVE-2020-9054, a critical flaw that exists in many VPN firewalls and network attached storage (NAS) devices made by Taiwanese vendor Zyxel Communication Corp., which boasts some 100 million devices deployed worldwide.
Like other Mirai variants, Mukashi constantly scans the Internet for vulnerable IoT devices like security cameras and digital video recorders (DVRs), looking for a range of machines protected only by factory-default credentials or commonly-picked passwords.
Palo Alto said IoT systems infected by Mukashi then report back to a control server, which can be used to disseminate new instructions — such as downloading additional software or launching distributed denial of service (DDoS) attacks.
The commands Mukashi botmasters can send to infected devices include scanning for and exploiting other systems, and launching DDoS attacks. Image: Palo Alto Networks.
Zyxel issued a patch for the flaw on Feb. 24, but the update did not fix the problem on many older Zyxel devices which are no longer being supported by the company. For those devices, Zyxel’s advice was not to leave them connected to the Internet.
A joint advisory on CVE-2020-9054 from the U.S. Department of Homeland Security and the CERT Coordination Center rates this vulnerability at a “10” — the most severe kind of flaw. The DHS/CERT advisory also includes sample code to test if a Zyxel product is vulnerable to the flaw.
My advice? If you can’t patch it, pitch it, as Mukashi is not the only thing interested in this Zyxel bug: Recent activity suggests attackers known for deploying ransomware have been actively working to test it for use against targets.
Text extracted automatically; images, tables and formatting may be missing. Original: https://krebsonsecurity.com/2020/03/zxyel-flaw-powers-new-mirai-iot-botnet-strain/