Black Arrow Cyber Advisory 06 June 2023 – Zyxel Firewall Vulnerability Under Active Exploitation - Patch Now
Executive Summary
A number of recently disclosed vulnerabilities in Zyxel firewalls are now known to be being actively exploited by malicious actors.
Two of these exploited vulnerabilities are buffer overflows which enable an unauthenticated attacker to cause a denial-of-service (DoS) condition and remote code execution. In addition, a further critical vulnerability has been disclosed which allows an unauthenticated attacker to execute operating system commands to remotely send packets to a device.
These vulnerabilities have been added to the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog: Known Exploited Vulnerabilities Catalog | CISA
What’s the risk to me or my business?
The vulnerabilities, if exploited, allow an attacker to execute remote code and cause a denial of service. If this occurs it can allow an attacker to disable or modify the firewall rules, allowing further malicious attacks to breach the network – all of which impact the confidentiality, integrity and availability of data of the organisation.
Technical Summary
CVE-2023-3309 – A buffer overflow vulnerability in the notification function in some firewall versions could allow an unauthenticated attacker to cause DoS conditions and even remotely execute code on an affected device.
CVE-2023-33010 – A buffer overflow vulnerability in the ID processing function in some firewall versions could allow an unauthenticated attacker to cause DoS conditions and even motely execute code on an affected device.
CVE-2023-28771 – Improper error message handling in some firewall versions could allow an unauthenticated attacker to execute some operating system commands remotely by sending crafted packets to an affected device.
The affected firewall products and versions are patched in version ZLD V5.36 Patch 2:
- ATP – versions: ZLD V4.32 to V5.36 Patch 1
- USG FLEX – versions: ZLD V4.50 to V5.36 Patch 1
- USG FLEX50(W)/USG20(W)-VPN – versions: ZLD V4.25 to V5.36 Patch 1
- VPN – versions: ZLD V4.30 to V5.36 Patch 1
The following affected product and versions are patched in version ZLD V4.73 Patch 2:
- ZyWALL/USG – versions: ZLD V4.25 to V4.73 Patch 1
What can I do?
It is recommended that patches are applied immediately for the impacted products. Zyxel has also issued guidance to disable HTTP/HTTPS services from the Wide Area Network (WAN) unless absolutely required, and to disable UDP ports 500 and 4500 if not in use. If you are unsure, it is advised to check with your MSP.
Further information can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity