Network equipment maker, Zyxel has released security updates to address a critical vulnerability that affect some of Zyxel’s business firewall and VPN solutions. The flaw, which is tracked as CVE-2022-0342, allows an attacker to take control of the devices. The bug was reported by Alessandro Sgreccia from Tecnical Service Srl and Roberto Garcia H and Victor Garcia R from Innotec Security.
Authentication bypass vulnerability
Zyxel published the list of affected products after an investigation. Vulnerable products are:
- USG/ZyWALL running firmware versions ZLD V4.20 through ZLD V4.70 (fixed in ZLD V4.71)
- USG FLEX running firmware versions ZLD V4.50 through ZLD V5.20 (fixed in ZLD V5.21 Patch 1)
- ATP running firmware versions ZLD V4.32 through ZLD V5.20 (fixed in ZLD V5.21 Patch 1)
- VPN running firmware versions ZLD V4.30 through ZLD V5.20 (fixed in ZLD V5.21)
- NSG running firmware versions V1.20 through V1.33 Patch 4 (Hotfix V1.33p4_WK11 available now, with standard patch V1.33 Patch 5 expected in May 2022)
The company also stated that currently there is no evidence that shows that vulnerability is being exploited in the wild. The company urged users to apply the patch as soon as possible to prevent any potential threats. Zyxel said,
« An authentication bypass vulnerability caused by the lack of a proper access control mechanism has been found in the CGI program of some firewall versions. The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device. »