Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

Posted by & filed under Ειδοποιήσεις.

Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded, undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices.

The flaw, tracked as CVE-2020-29583 (CVSS score 7.8), affects version 4.60 present in a wide-range of Zyxel devices, including Unified Security Gateway (USG), USG FLEX, ATP, and VPN firewall products.

EYE researcher Niels Teusink reported the vulnerability to Zyxel on November 29, following which the company released a firmware patch (ZLD V4.60 Patch1) on December 18.

According to the advisory published by Zyxel, the undocumented account (“zyfwp”) comes with an unchangeable password that’s not only stored in plaintext but could also be used by a malicious third-party to login to the SSH server or web interface with admin privileges.

Zyxel said the hardcoded credentials were put in place to deliver automatic firmware updates to connected access points through FTP.

Noting that around 10% of 1000 devices in the Netherlands run the affected firmware version, Teusink said the flaw’s relative ease of exploitation makes it a critical vulnerability.

“As the ‘zyfwp‘ user has admin privileges, this is a serious vulnerability,” Teusink said in a write-up. “An attacker could completely compromise the confidentiality, integrity and availability of the device.”

“Someone could for example change firewall settings to allow or block certain traffic. They could also intercept traffic or create VPN accounts to gain access to the network behind the device. Combined with a vulnerability like Zerologon this could be devastating to small and medium businesses.”

 

The Taiwanese company is also expected to address the issue in its access point (AP) controllers with a V6.10 Patch1 that’s set to be released in April 2021.

It’s highly recommended that users install the necessary firmware updates to mitigate the risk associated with the flaw.

 

The information contained in this website is for general information purposes only. The information is gathered from The Hacker News, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.  Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.