Zyxel addresses Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-9054 | Pre-Authentication OS Command Injection in Zyxel NAS Devices CVE-2020-9054 is a pre-authentication OS command injection flaw (CWE-78) in multiple Zyxel network-attached storage (NAS) devices. A remote, unauthenticated attacker can send crafted input to the devices' web interface to inject and execute arbitrary OS commands without logging in, resulting in remote code execution on the NAS. Successful exploitation gives the attacker control of the device, which can be used to access, alter or destroy stored data and to pivot into the network the NAS is attached to. Organizations and users running affected Zyxel NAS models are at risk, especially where the management web interface is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, confirming exploitation in the wild; EPSS assigns a 100% probability of exploitation within 30 days, while no public proof-of-concept is known and any ransomware use is unconfirmed. Do: Apply the firmware updates specified in Zyxel's advisory, per CISA's required action, prioritizing any NAS whose web interface is exposed to the internet. Until patched, restrict the NAS management interface to trusted networks or VPN access and do not expose the admin UI directly to the internet. Because exploitation is confirmed in the wild, check affected devices for indicators of compromise, such as unexpected accounts, scheduled jobs, or outbound connections. | 9.8 | 100% | KEV PoC |
| moderateplausibly tens of thousands of affected devices installed worldwide, with only a low-thousands subset directly internet-exposed |
Full article596 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 25, 2020
Tech vendor Zyxel addresses a critical vulnerability in several network-attached storage (NAS) devices that is already being exploited in the wild.
Zyxel has released security patches to address a critical remote code execution vulnerability, tracked as CVE-2020-9054, that affects several NAS devices. The flaw can be exploited by an unauthenticated attacker, it resides in the weblogin.cgi CGI executable that doesn’t correctly sanitize the username parameter passed to it.
An attacker could include certain characters in the username passed the executable to trigger the vulnerability and carry out command injection with the privileges of the webserver.
“Multiple ZyXEL network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.” reads the advisory published by CERT/CC.
“ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device.”
Experts explained that ZyXEL NAS devices include a setuid utility that can be used to run any command with root privileges.
Experts at CERT/CC warn of the availability online of working exploit code for this issue, for this reason, they have created a PoC exploit that power down affected ZyXEL devices.
According to the popular investigator Brian Krebs, a working exploit is available for sale on underground forums for $20,000. Krebs shared his discovery with the vendor and the experts at DHS, and CERT/CC.
“Zyxel NAS (Network Attached Storage) products are affected by a remote code execution vulnerability. Users are advised to install the hotfixes or follow the workaround immediately for optimal protection.” reads the advisory published by Zyxel.
“A remote code execution vulnerability was identified in the weblogin.cgi program of Zyxel NAS products running firmware version 5.21 and earlier. Missing authentication for the program could allow attackers to perform remote code execution via OS command injection,”
An attacker could exploit the vulnerability by sending a specially-crafted HTTP POST or GET request. The issue could be also triggered if the attacker does not have direct connectivity to the device, but he is able to trick the victim into visiting a malicious website.
The vulnerability could be exploited by threat actors in the wild for large-scale attacks.
“the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.” wrote Krebs. “recent activity suggests that attackers known for deploying ransomware have been actively working to test the zero-day for use against targets.” “Specifically, Holden said the exploit is now being used by a group of bad guys who are seeking to fold the exploit into Emotet, a powerful malware tool typically disseminated via spam that is frequently used to seed a target with malcode which holds the victim’s files for ransom. “
Zyxel released security fixes for NAS326, NAS520, NAS540, and NAS542 devices, but the NAS devices NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 will not receive any patch because are no longer supported by the vendor
“Do not leave the product directly exposed to the internet. If possible, connect it to a security router or firewall for additional protection,” Zyxel recommends.
CERT/CC also provides mitigations such as blocking access to the web interface (80/tcp and 443/tcp) and avoiding exposing the NAS to the Internet.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Zyxel)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/98461/hacking/zyxel-critical-rce.html