Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability

Zyxel has moved to tackle a critical security vulnerability influencing Zyxel firewall units that permits unauthenticated and remote attackers to obtain arbitrary code execution.

“A command injection vulnerability in the CGI plan of some firewall variations could let an attacker to modify unique files and then execute some OS commands on a vulnerable machine,” the business mentioned in an advisory posted Thursday.

Cybersecurity organization Fast7, which discovered and reported the flaw on April 13, 2022, stated that the weak spot could allow a distant unauthenticated adversary to execute code as the “no person” user on impacted appliances.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Tracked as CVE-2022-30525 (CVSS rating: 9.8), the flaw impacts the following goods, with patches unveiled in version ZLD V5.30 –

• USG FLEX 100(W), 200, 500, 700
• USG FLEX 50(W) / USG20(W)-VPN
• ATP collection, and
• VPN series

Immediate 7 observed that there are at the very least 16,213 vulnerable Zyxel units uncovered to the internet, earning it a profitable attack vector for menace actors to phase possible exploitation makes an attempt.

The cybersecurity agency also pointed out that Zyxel silently issued fixes to tackle the issue on April 28, 2022 devoid of publishing an related Popular Vulnerabilities and Exposures (CVE) identifier or a security advisory. Zyxel, in its inform, blamed this on a “miscommunication during the disclosure coordination system.”

“Silent vulnerability patching tends to only assist energetic attackers, and leaves defenders in the dark about the genuine risk of recently discovered issues,” Speedy7 researcher Jake Baines claimed.

The advisory comes as Zyxel dealt with a few distinctive issues, together with a command injection (CVE-2022-26413), a buffer overflow (CVE-2022-26414), and a area privilege escalation (CVE-2022-0556) flaw, in its VMG3312-T20A wireless router and AP Configurator that could lead to arbitrary code execution.

Observed this posting fascinating? Comply with THN on Facebook, Twitter  and LinkedIn to read through a lot more special articles we article.