Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Zyxel is a trademark name that is used by both Zyxel Communications Corp. and Zyxel Networks, two companies that are involved in the production of networking equipment as well as the provision of services to communications service providers. Zyxel firms have their headquarters in Hsinchu, Taiwan, with branch offices all around the world, including in North America, Europe, and Asia.
Zyxel products are used by large businesses, which means that any vulnerabilities in them that might be exploited rapidly attract the attention of threat actors.
What Happened?
Zyxel has released a security warning to inform administrators about several vulnerabilities that are present in a diverse selection of its firewall, access point (AP), and access point controller (AP controller) devices.
Even though the vulnerabilities do not have a critical severity rating, they are still important when taken by themselves and may be utilized by threat actors as links in exploit chains.
As reported by BleepingComputer, The four flaws disclosed in Zyxel’s advisory are the following:
A cross-site scripting vulnerability was identified in the CGI program of some firewall versions that could allow an attacker to obtain some information stored in the user’s browser, such as cookies or session tokens, via a malicious script.
Multiple improper input validation flaws were identified in some CLI commands of some firewall, AP controller, and AP versions that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.
A command injection vulnerability in the “packet-trace” CLI command of some firewall, AP controller, and AP versions could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the command.
An authentication bypass vulnerability caused by the lack of a proper access control mechanism has been found in the CGI program of some firewall versions. The flaw could allow an attacker to downgrade from two-factor authentication to one-factor authentication via an IPsec VPN client.
The vulnerabilities described above have an effect on USG/ZyWALL, USG FLEX, ATP, VPN, NSG firewalls, NXC2500 and NXC5500 AP controllers, as well as a variety of Access Point devices, including as models from the NAP, NWA, WAC, and WAX series.
Zyxel has made available the security upgrades that provide solutions to the issues for most of the affected devices, and although the severity of these vulnerabilities is not very high, administrators of networks are nonetheless highly encouraged to update their equipment as soon as practicable.
Follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
Dora is a digital marketing specialist within Heimdal™ Security. She is a content creator at heart - always curious about technology and passionate about finding out everything there is to know about cybersecurity.
