{"id":5158,"date":"2022-06-16T09:49:40","date_gmt":"2022-06-16T07:49:40","guid":{"rendered":"https:\/\/allcore.be\/news\/hackers-exploit-critical-bug-in-zyxel-firewalls-and-vpns\/"},"modified":"2023-06-21T11:58:40","modified_gmt":"2023-06-21T09:58:40","slug":"hackers-exploit-critical-bug-in-zyxel-firewalls-and-vpns","status":"publish","type":"post","link":"https:\/\/allcore.be\/en\/news\/hackers-exploit-critical-bug-in-zyxel-firewalls-and-vpns\/","title":{"rendered":"Hackers exploit critical bug in Zyxel firewalls and VPNs"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Hackers have begun exploiting a recently patched critical vulnerability, traced as CVE-2022-30525, that affects Zyxel firewall and enterprise VPN devices.<\/strong><\/p>

Successful exploitation allows a remote attacker to inject arbitrary commands without authentication, making it possible to set up a reverse shell.<\/p>

Getting a shell<\/h3>

The vulnerability was discovered byJacob Baines<\/a>, chief security researcher at Rapid7, explaining in a brief technical report how the flaw can be exploited in attacks. A module has been added to the Metasploit penetration testing framework.<\/p>

“Commands are executed when the user nobody. This vulnerability is exploited via the \/ztp\/cgi-bin\/handler URI and is the result of passing unsanitized attacker input to the os.system method in lib_wan_settings.py”- Jacob Baines<\/a><\/p><\/div>

The researcher notes that an attacker could set up a reverse shell using the normal bash GTFOBin<\/a>.<\/p>

\"Setting
source: Rapid7<\/a><\/em><\/figcaption><\/figure><\/div>

Zyxel issued a security advisory for CVE-2022-30525 (9.8 critical severity score) on May 12, announcing that a fix had been released<\/a>for the affected models and urging administrators to install the latest updates:<\/p>
Affected model<\/th>Affected firmware version<\/th>Patch availability<\/th><\/tr>
USG FLEX 100(W), 200, 500, 700<\/td>ZLD V5.00 through ZLD V5.21 Patch 1<\/td>ZLD V5.30<\/td><\/tr>
USG FLEX 50(W) \/ USG20(W)-VPN<\/td>ZLD V5.10 through ZLD V5.21 Patch 1<\/td>ZLD V5.30<\/td><\/tr>
ATP series<\/td>ZLD V5.10 through ZLD V5.21 Patch 1<\/td>ZLD V5.30<\/td><\/tr>
VPN series<\/td>ZLD V4.60 through ZLD V5.21 Patch 1<\/td>ZLD V5.30<\/td><\/tr><\/tbody><\/table>

The severity of the security problem and the damage it could lead to is serious enough for the NSA Cybersecurity DirectorRob Joyce To warn users of exploitation<\/a> and encourage them to update the firmware version of the device if it is vulnerable.<\/p>

As of Friday the 13th, security experts from the non-profittShadowserver Foundation<\/a> reported seeing attempts at exploitation for CVE-2022-30525.<\/p>

It is unclear whether these attempts are malicious or simply researchers working to map Zyxel devices that are currently exposed to attacks from advertisers.<\/p>

\"Shadowserver<\/a><\/p>

Rapid7 scanned the Internet for vulnerable Zyxel products and found more than 15,000 using the Shodan search platform for Internet-connected hardware.<\/p>

\"Zyxel
source: Rapid7<\/a><\/em><\/figcaption><\/figure><\/div>

Shadowserver performed its own scan and found at least 20,800 Zyxel firewall models on the open web<\/a> that may be affected by the vulnerability.<\/p>

The organization counted the hardware by unique IP addresses and discovered that more than 15,000 of them were USG20-VPN<\/a> and USG20W-VPN, models designed for “VPN connections between branches and retail chains.”<\/p>

The region with the most potentially vulnerable devices is the European Union, with France and Italy having the largest number.<\/p>

\"Geographic<\/a>
source: Shadowserver Foundation<\/em><\/figcaption><\/figure><\/div>

Detect attempts at abuse<\/h3>

Given the severity of the vulnerability and the popularity of the devices, security researchers have released code to help administrators detect the security hole and exploitation attempts.<\/p>

As part of the rescue team of Spanish telecom company Telef\u00f3nica,z3r00t<\/a>created and published a template for the Nuclei vulnerability scanning solution to detect CVE-2022-30525. The Template is available on the author’s GitHub.<\/a><\/p>

Another researcher, BlueNinja<\/a>, also created a script to detect the unauthenticated remote command injection in Zyxel firewall and VPN products and published it on GitHub.<\/a><\/p>

<\/p>

Source: Bleepingcomputer.com<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Hackers have begun exploiting a recently patched critical vulnerability, traced as CVE-2022-30525, that affects Zyxel firewall and enterprise VPN devices.<\/p>\n","protected":false},"author":3,"featured_media":5005,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5158","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/posts\/5158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/comments?post=5158"}],"version-history":[{"count":3,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/posts\/5158\/revisions"}],"predecessor-version":[{"id":5161,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/posts\/5158\/revisions\/5161"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/media\/5005"}],"wp:attachment":[{"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/media?parent=5158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/categories?post=5158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/allcore.be\/en\/wp-json\/wp\/v2\/tags?post=5158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}