Over 20,000 Zyxel Firewalls Still Exposed to Critical Bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30525 | OS Command Injection in Zyxel Firewalls Enables Remote Command Execution CVE-2022-30525 is an OS command injection vulnerability (CWE-78) in the CGI program of certain Zyxel firewall firmware versions. By sending crafted requests to the vulnerable CGI program, an attacker can modify specific files on the appliance and inject and execute operating system commands. Successful exploitation yields command execution on the firewall itself, allowing an attacker to alter device files/configuration and potentially pivot into the protected network — the class of edge-device flaw commonly targeted by ransomware operators (ransomware use in this case is not yet confirmed). Organizations running affected Zyxel firewalls, particularly those with management interfaces reachable from the internet, are at risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-05-16, EPSS assigns a 99.9% 30-day exploitation probability (100th percentile), and no public PoC is catalogued yet. Do: Apply Zyxel's fixed firmware per the vendor's instructions immediately, as required by the CISA KEV listing. Until patched, restrict HTTP/HTTPS management access to the firewall to trusted source addresses only. Because exploitation is confirmed in the wild, prioritize internet-facing Zyxel firewalls and review devices for indicators of compromise such as modified configurations or unexpected administrative changes. | 9.8 | 100% | KEV PoC ×3 |
| large≈ tens of thousands of internet-exposed Zyxel firewall management interfaces (order of magnitude 10k–100k devices) |
Full article444 words · extracted from infosecurity-magazine.com · click to collapse
Written by
Customers of a popular firewall manufacturer are being urged to patch a critical vulnerability fixed by the vendor back in April, after researchers warned of in-the-wild exploits.
Zyxel updated its ATP series, VPN series, and USG FLEX series of products on April 28 after Rapid7 discovered and responsibly disclosed CVE-2022-30525.
The bug “allows an unauthenticated and remote attacker to achieve arbitrary code execution as the nobody user on the affected device,” according to a lead security researcher at the firm, Jake Baines.
“The affected models are vulnerable to unauthenticated and remote command injection via the administrative HTTP interface. Commands are executed as the nobody user,” he continued.
“This vulnerability is exploited through the /ztp/cgi-bin/handler URI and is the result of passing unsanitized attacker input into the os.system method in lib_wan_settings.py. The vulnerable functionality is invoked in association with the setWanPortSt command. An attacker can inject arbitrary commands into the mtu or the data parameter.”
Over the weekend, non-profit security organization the Shadowserver Foundation tweeted that it began seeing exploitation attempts on Friday.
— Shadowserver (@Shadowserver) May 15, 2022We see at least 20 800 of the potentially affected Zyxel firewall models (by unique IP) accessible on the Internet. Most popular are USG20-VPN (10K IPs) and USG20W-VPN (5.7K IPs).
Most of the CVE-2022-30525 affected models are in the EU - France (4.5K) and Italy (4.4K). pic.twitter.com/Wh7I8JCvVv
“We see at least 20,800 of the potentially affected Zyxel firewall models (by unique IP) accessible on the internet. Most popular are USG20-VPN (10K IPs) and USG20W-VPN (5.7K IPs),” it explained. “Most of the CVE-2022-30525 affected models are in the EU – France (4.5K) and Italy (4.4K).”
According to Shadowserver, the next most common locations for exposed Zyxel firewalls are the US (2400), followed by Switzerland (1700) and Russia (854).
However, despite Rapid7’s responsible disclosure of the vulnerability, there appears to have been a communication breakdown with the Taiwanese firewall manufacturer after that.
In fact, Zyxel released a patch in late April without coordinating with the researchers, publishing an advisory or reserving a CVE. Rapid7 believes this may have unwittingly aided threat actors.
“This patch release is tantamount to releasing details of the vulnerabilities, since attackers and researchers can trivially reverse the patch to learn precise exploitation details, while defenders rarely bother to do this,” argued Baines.
“Therefore, we’re releasing this disclosure early in order to assist defenders in detecting exploitation and to help them decide when to apply this fix in their own environments, according to their own risk tolerances. In other words, silent vulnerability patching tends to only help active attackers, and leaves defenders in the dark about the true risk of newly discovered issues.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/20000-zyxel-firewalls-critical-bug/