Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials

guest · Sep 3, 2019

Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials
September 3, 2019
https://www.securityweek.com/zyxel-devices-can-be-hacked-dns-requests-hardcoded-credentials

The first issue impacts Zyxel security and networking devices from the USG, UAG, ATP, VPN and NXC products, which are prone to unauthenticated DNS requests, a SEC Consult advisory reads.

The security bug could allow unauthenticated users to check whether a domain is present or not via the web login interface. The IP address is embedded in the response if the host with the corresponding domain is present.

“A DNS request can be made by an unauthenticated attacker to either spam a DNS service of a third party with requests that have a spoofed origin or probe whether domain names are present on the internal network behind the firewall,” the advisory reads.
SEC Consult also discovered that hardcoded FTP credentials are present in multiple Zyxel Wi-Fi access points from the NWA, NAP and WAC series.

Zyxel customers are advised to install the patches and firmware updates for their devices as soon as possible.
SEC Consult’s advisories also include lists with all of the devices impacted by these vulnerabilities.
Click to expand...

Log in or Sign up

Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials

guest Guest

Log in or Sign up

Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials

guest Guest

Useful Searches