Flaws Riddle Zyxel’s Network Management Software

guest · Mar 12, 2020

Flaws Riddle Zyxel’s Network Management Software
Over 16 security flaws, including multiple backdoors and hardcoded SSH server keys
March 11, 2020
https://threatpost.com/flaws-zyxels-network-management-software/153554/

Security researchers are warning that networking hardware vendor Zyxel and its Cloud CNM SecuManager software is chock-full of unpatched vulnerabilities that kick open the doors for hackers to exploit. In all, researchers have identified 16 vulnerabilities, ranging from multiple backdoors and default credentials to insecure memory storage.

The Zyxel CNM SecuManager is a networking management software solution that provides an integrated console to monitor and manage enterprise security gateways, such as the company’s own ZyWALL USG and its VPN series products.

However, security researchers Pierre Kim and Alexandre Torres wrote in a report posted Monday that “the attack surface is very large and many different stacks are being used making it very interesting. Furthermore, some daemons are running as root and are reachable from the WAN. Also, there is no firewall by default.” The report outlined the more than a dozen flaws.
Click to expand...

Researcher Kim told Threatpost he did not disclose the vulnerabilities to Zyxel because he believed that the vendor intentionally created backdoors into its product that would open Cloud CNM SecuManager software to remote access by Zyxel, post-customer installation.

“The only effective way when dealing with backdoors planted with the vendor is to publish zero-day vulnerabilities using full disclosure,” he said. “By going full disclosure, the vendor will be forced to remove the backdoors.”
Yen did not address those claims by the researchers.
Click to expand...

guest · Apr 22, 2020

Fast-Moving DDoS Botnet Exploits Unpatched ZyXel RCE Bug
April 22, 2020
https://threatpost.com/fast-moving-ddos-botnet-unpatched-zyxel-rce-bug/155059/

A new variant of the Hoaxcalls botnet, which can be marshalled for large-scale distributed denial-of-service (DDoS) campaigns, is spreading via an unpatched vulnerability impacting the ZyXEL Cloud CNM SecuManager that was disclosed last month.

That’s according to researchers at Radware, who also said that it’s notable how quickly Hoaxcalls operators have moved to weaponize the ZyXel bug, which as of this time of writing, has still not been addressed in a ZyXel advisory.
The Rise of Hoaxcalls
According to the Palo Alto Unit 42 researchers who found it, the original sample featured three DDoS attack vectors: UDP, DNS and HEX floods; and, it was seen infecting devices through two vulnerabilities: A DrayTek Vigor2960 remote code-execution (RCE) vulnerability and a GrandStream Unified Communications remote SQL injection bug (CVE-2020-5722).

“While IoT botnet variants are common, these samples highlight not only the speed in which criminals move, but also the depth and scope of the campaigns run by DDoS operators,” noted Radware researchers, in an analysis posted on Wednesday.
Click to expand...

ZyXel RCE Bug
The April 20 variant most notably uses an unpatched vulnerability in the ZyXEL Cloud CNM SecuManager, which is a network management appliance designed to provide an integrated console to monitor and manage security gateways.
Click to expand...

Log in or Sign up

Flaws Riddle Zyxel’s Network Management Software

guest Guest

guest Guest

Log in or Sign up

Flaws Riddle Zyxel’s Network Management Software

guest Guest

guest Guest

Useful Searches