Zyxel Patched Quite a few Safety Flaws Throughout Totally different Merchandise

Zyxel started the month by releasing quite a few safety fixes for flaws in its firewalls and router gadgets. Essentially the most important safety vulnerability affected its routers, exploiting which may enable OS command injection.

Essential OS Command Injection Impacted Zyxel Routers

In keeping with its advisory, an OS command injection vulnerability affected totally different Zyxel routers. Recognized as CVE-2024-7261, the agency described this vulnerability as an OS command injection flaw in some entry factors (AP) and safety router variations.

Elaborating on this vulnerability and the affected gadgets, its CVE itemizing states,

The improper neutralization of particular components within the parameter “host” within the CGI program of Zyxel NWA1123ACv3 firmware model 6.70(ABVT.4) and earlier, WAC500 firmware model 6.70(ABVS.4) and earlier, WAX655E firmware model 7.00(ACDO.1) and earlier, WBE530 firmware model 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware model V2.00(ACIP.2) may enable an unauthenticated attacker to execute OS instructions by sending a crafted cookie to a weak gadget.

This vulnerability acquired a important severity ranking and a CVSS rating of 9.1. Zyxel launched its safety repair with the newest AP and safety router firmware variations, mentioning them in its advisory. Customers should guarantee to replace their gadgets accordingly to obtain the patch.

Extreme Buffer Overflow Additionally Patched For Totally different Merchandise

One other necessary vulnerability repair, launched concurrently, addressed a high-severity buffer overflow problem. This vulnerability, recognized as CVE-2024-5412, acquired a CVSS rating of seven.5.

The flaw affected some 5G NR/4G LTE CPE, DSL/Ethernet CPE, fiber ONT, WiFi extenders, and safety router gadgets. It allowed an unauthenticated adversary to set off a denial of state on the goal gadget by sending maliciously crafted HTTP requests.

Zyxel shared an in depth checklist of affected merchandise and their respective patched releases in its advisory.

A number of Securit Flaws Addressed Throughout Zyxel Firewalls

Along with the 2 safety fixes described above, Zyxel additionally patched seven different safety flaws affecting a number of firewall variations. These vulnerabilities embody,

• CVE-2024-6343 (medium; CVSS 4.9): a buffer overflow vulnerability within the CGI program that would let an authenticated adversary with admin privileges set off a denial of service.
• CVE-2024-7203 (excessive; CVSS 7.2): a post-authentication OS command injection that an adversary may execute through maliciously crafted CLI instructions.
• CVE-2024-42057 (excessive; CVSS 8.1): An OS command injection vulnerability impacting the IPSec VPN characteristic of firewalls permitting assaults from an unauthenticated attacker.
• CVE-2024-42058 (excessive; CVSS 7.5): a null pointer dereference vulnerability that allowed DoS assaults from an unauthenticated adversary.
• CVE-2024-42059 (excessive; CVSS 7.2): one other post-authentication OS command injection vulnerability that an authenticated adversary may exploit by importing a crafted compressed language file through FTP.
• CVE-2024-42060 (excessive; CVSS 7.2): An authenticated attacker may exploit this OS command injection vulnerability by importing a crafted inside consumer settlement file to the goal gadget.
• CVE-2024-42061 (medium; CVSS 6.1): a mirrored cross-site scripting (XSS) within the CGI program dynamic_script.cgi of firewalls.

The vulnerabilities affected totally different fashions of Zyxel ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN. Zyxel patched all of the affected gadgets with the newest software program releases, sharing the main points in its advisory. Customers should be sure that their gadgets are patched with the newest variations to forestall potential threats.

Tell us your ideas within the feedback.