Thousands of Zyxel firewalls could be vulnerable to remote attacks due to a vulnerability discovered recently by cybersecurity firm Rapid7. The vendor was quick to release a patch, but it did not immediately inform customers about it.
The flaw, tracked as CVE-2022-30525, affects ATP, VPN and USG FLEX series firewalls. The vulnerability can be exploited by a remote, unauthenticated attacker for arbitrary code execution as the “nobody” user.
The affected products are recommended for businesses and they provide VPN, SSL inspection, intrusion protection, web filtering and email security capabilities. The Shodan search engine shows more than 15,000 potentially affected devices that are exposed to the internet.
The vulnerability found by Rapid7 has been described as an unauthenticated command injection issue that can be exploited through a device’s HTTP interface. The company has explained how an attacker could exploit the weakness to obtain a reverse shell.
A Metasploit module that exploits the vulnerability has also been made available.
The vulnerability was discovered in early April and Zyxel silently patched the issue the same month. Both Rapid7 and Zyxel publicly disclosed the vulnerability on May 12.
“This patch release is tantamount to releasing details of the vulnerabilities, since attackers and researchers can trivially reverse the patch to learn precise exploitation details, while defenders rarely bother to do this,” Rapid7 said.
“Therefore, we're releasing this disclosure early in order to assist defenders in detecting exploitation and to help them decide when to apply this fix in their own environments, according to their own risk tolerances. In other words, silent vulnerability patching tends to only help active attackers, and leaves defenders in the dark about the true risk of newly discovered issues,” the company added.
It’s important that users install the patches from Zyxel as threat actors have been known to exploit vulnerabilities affecting the company’s products, including firewalls.
Related: Over 20 Zyxel Firewalls Impacted by Recent Zero-Day Vulnerability
Related: Many Backdoors Found in Zyxel CloudCNM SecuManager Software
Related: Hardcoded Credentials Expose Zyxel Firewalls and WLAN Controllers to Remote Attacks
Related: Zyxel Patches Zero-Day Vulnerability in Network Storage Products
