Skip to main content

Zyxel Releases Security Updates

Security updates address vulnerabilities in Zyxel ATP, USG, and VPN products, including a command injection vulnerability

Threat ID:
CC-4310
Threat Severity:
Information only
Published:
25 April 2023 5:11 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address vulnerabilities in Zyxel ATP, USG, and VPN products, including a command injection vulnerability

The following platforms are also known to be affected:

Access Points:

  • NAP203         
  • NAP303         
  • NAP353         
  • NWA110AX  
  • NWA1123-AC-PRO  
  • NWA1123ACv3                    
  • NWA210AX  
  • NWA220AX-6E        
  • NWA50AX                
  • NWA50AX-PRO                   
  • NWA5123-AC HD    
  • NWA90AX    
  • NWA90AX-PRO       
  • WAC500        
  • WAC500H     
  • WAC5302D-Sv2       
  • WAC6103D-I
  • WAC6303D-S
  • WAC6502D-E
  • WAC6502D-S
  • WAC6503D-S
  • WAC6552D-S
  • WAC6553D-E           
  • WAX510D     
  • WAX610D     
  • WAX620D-6E
  • WAX630S     
  • WAX640S-6E
  • WAX650S     
  • WAX655E     

Threat details

Exploitation in the wild for CVE-2023-28771

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-28771 to their Known Exploited Vulnerability Catalog, an OS command injection vulnerability that could allow a remote, unauthenticated attacker to execute some OS commands by sending crafted packets to an affected system.

Introduction

Zyxel has released security updates to address vulnerabilities in a range of products and access points, including Zyxel VPN, ATP and USG. A Critical severity vulnerability affects ATP, USG FLEX, VPN, and ZyWALL/USG, which could allow an unauthenticated attacker to execute remote commands by sending maliciously crafted packets to an affected device.

Zyxel releases additional mitigation guidance for CVE-2023-28771

Zyxel has published additional guidance relating to vulnerability CVE-2023-28771 for temporary mitigation and precautionary purposes:

  1. Unless it is absolutely necessary for devices to be managed from the WAN side, HTTP/HTTPS services should be disabled from the WAN.
  2. If devices still need to be managed from the WAN side:
    • Enable Policy Control and add rules to only allow access from trusted source IP addresses; and
    • Enable GeoIP filtering to only allow access from trusted locations.
  3. If use of the IPSec VPN function is not required, disable the UDP Port 500 and Port 4500.

Threat updates

Date Update
5 Jun 2023 Zyxel releases additional mitigation guidance for CVE-2023-28771

This cyber alert has been updated to reflect this change.
1 Jun 2023 Exploitation in the wild for CVE-2023-28771

This cyber alert has been updated to reflect this change.

Remediation advice

Affected organisations are encouraged to review Zyxel's security advisories and apply the relevant updates.

Remediation steps

Type Step
Patch

Zyxel security advisory for XSS vulnerability and post-authentication command injection vulnerability in firewalls

  • ATP       
  • USG FLEX            
  • USG FLEX 50(W) / USG20(W)-VPN
  • VPN      

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-and-post-authentication-command-injection-vulnerability-in-firewalls
Patch

Zyxel security advisory for OS command injection vulnerability of firewalls

  • ATP       
  • USG FLEX            
  • VPN
  • ZyWALL/USG

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls
Patch

Zyxel security advisory for multiple vulnerabilities of firewalls and access points

  • ATP       
  • USG FLEX            
  • USG FLEX 50(W) / USG20(W)-VPN
  • VPN      
  • Access points listed above

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps

CVE Vulnerabilities

Status Published

CVE-2023-27990

The XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.
Status Published

CVE-2023-27991

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.
Status Published

CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.
Status Published

CVE-2023-22913

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker to modify device configuration data, resulting in denial-of-service (DoS) conditions on an affected device.
Status Published

CVE-2023-22914

A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker with administrator privileges to execute unauthorized OS commands in the “tmp” directory by uploading a crafted file if the hotspot function were enabled.
Status Published

CVE-2023-22915

A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote unauthenticated attacker to cause DoS conditions by sending a crafted HTTP request if the Facebook WiFi function were enabled on an affected device.
Status Published

CVE-2023-22916

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50(W) firmware versions 5.10 through 5.35, USG20(W)-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails to properly sanitize user input. A remote unauthenticated attacker could leverage the vulnerability to modify device configuration data, resulting in DoS conditions on an affected device if the attacker could trick an authorized administrator to switch the management mode to the cloud mode.
Status Published

CVE-2023-22917

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN firmware versions 5.10 through 5.32, and VPN series firmware versions 5.00 through 5.35, which could allow a remote unauthenticated attacker to cause a core dump with a request error message on a vulnerable device by uploading a crafted configuration file.
Status Published

CVE-2023-22918

A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Last edited: 5 June 2023 1:59 pm