Over 20,000 Zyxel Firewalls Still Exposed to Critical Bug

Consumers of a popular firewall manufacturer are staying urged to patch a critical vulnerability fixed by the vendor again in April, following scientists warned of in-the-wild exploits.

Zyxel up-to-date its ATP collection, VPN series, and USG FLEX series of products and solutions on April 28 just after Immediate7 learned and responsibly disclosed CVE-2022-30525.

The bug “allows an unauthenticated and remote attacker to reach arbitrary code execution as the no person user on the afflicted device,” according to a guide security researcher at the business, Jack Baines.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“The affected versions are susceptible to unauthenticated and remote command injection by using the administrative HTTP interface. Commands are executed as the nobody user,” he continued.

“This vulnerability is exploited through the /ztp/cgi-bin/handler URI and is the result of passing unsanitized attacker enter into the os.procedure strategy in lib_wan_settings.py. The vulnerable operation is invoked in affiliation with the setWanPortSt command. An attacker can inject arbitrary instructions into the mtu or the knowledge parameter.”

About the weekend, non-financial gain security organization the Shadowserver Foundation tweeted that it began looking at exploitation attempts on Friday.

We see at the very least 20 800 of the probably affected Zyxel firewall versions (by exclusive IP) obtainable on the Internet. Most common are USG20-VPN (10K IPs) and USG20W-VPN (5.7K IPs). Most of the CVE-2022-30525 influenced designs are in the EU – France (4.5K) and Italy (4.4K). pic.twitter.com/Wh7I8JCvVv

— Shadowserver (@Shadowserver) Might 15, 2022

“We see at minimum 20,800 of the most likely afflicted Zyxel firewall types (by distinctive IP) available on the internet. Most well-liked are USG20-VPN (10K IPs) and USG20W-VPN (5.7K IPs),” it discussed. “Most of the CVE-2022-30525 impacted versions are in the EU – France (4.5K) and Italy (4.4K).”

According to Shadowserver, the next most frequent destinations for exposed Zyxel firewalls are the US (2400), followed by Switzerland (1700) and Russia (854).

Even so, regardless of Fast7’s responsible disclosure of the vulnerability, there appears to have been a communication breakdown with the Taiwanese firewall maker right after that.

In fact, Zyxel launched a patch in late April with no coordinating with the scientists, publishing an advisory or reserving a CVE. Fast7 believes this may well have unwittingly aided threat actors.

“This patch release is tantamount to releasing particulars of the vulnerabilities, because attackers and scientists can trivially reverse the patch to master precise exploitation details, even though defenders not often bother to do this,” argued Baines.

“Therefore, we’re releasing this disclosure early in buy to guide defenders in detecting exploitation and to help them choose when to apply this correct in their have environments, in accordance to their own risk tolerances. In other text, silent vulnerability patching tends to only aid energetic attackers, and leaves defenders in the dark about the genuine risk of recently found issues.”

Some areas of this write-up are sourced from:
www.infosecurity-journal.com