Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

guest · Jan 1, 2021

Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products
January 1, 2021
https://thehackernews.com/2021/01/secret-backdoor-account-found-in.html

Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices.

The flaw, tracked as CVE-2020-29583 (CVSS score 7.8), affects version 4.60 present in wide-range of Zyxel devices, including Unified Security Gateway (USG), USG FLEX, ATP, and VPN firewall products.
Click to expand...

According to the advisory published by Zyxel, the undocumented account ("zyfwp") comes with an unchangeable password ("PrOw!aN_fXp") that's not only stored in plaintext but could also be used by a malicious third-party to login to the SSH server or web interface with admin privileges.

Noting that around 10% of 1000 devices in the Netherlands run the affected firmware version, Teusink said the flaw's relative ease of exploitation makes it a critical vulnerability.

"As the 'zyfwp' user has admin privileges, this is a serious vulnerability," Teusink said in a write-up. "An attacker could completely compromise the confidentiality, integrity and availability of the device."
Click to expand...

Rasheed187 · Jan 2, 2021

Yes I read about it, truly ridiculous how leaky all of these devices are. I'm guessing that because of these type of flaws, so many companies are getting infected with ransomware for example.

guest · Jan 5, 2021

Hackers are exploiting a backdoor built into Zyxel devices. Are you patched?
January 4, 2021
https://arstechnica.com/information...oor-built-into-zyxel-devices-are-you-patched/

Hackers are attempting to exploit a recently discovered backdoor built into multiple Zyxel device models that hundreds of thousands of individuals and businesses use as VPNs, firewalls, and wireless access points.

The backdoor comes in the form of an undocumented user account with full administrative rights that’s hardcoded into the device firmware, a researcher from Netherlands-based security firm Eye Control recently reported. The account, which uses the username zyfwp, can be accessed over either SSH or through a Web interface.
Click to expand...

Andrew Morris, founder and CEO of security firm GreyNoise, said on Monday that his company’s sensors have detected automated attacks that are using the account credentials in an attempt to log in to vulnerable devices. In most or all of the login attempts, the attackers have simply added the credentials to existing lists of default username/password combinations used to hack into unsecured routers and other types of devices.
Click to expand...

For firewall models, a fix is already available. AP controllers, meanwhile, are scheduled to receive a fix on Friday. Zyxel said it designed the backdoor to deliver automatic firmware updates to connected access points over FTP.
Click to expand...

ronjor · Jan 8, 2021

MS-ISAC Releases Cybersecurity Advisory on Zyxel Firewalls and AP Controllers

Original release date: January 08, 2021
The Multi-State Information Sharing and Analysis Center (MS-ISAC) has released an advisory on a vulnerability in Zyxel firewalls and AP controllers. A remote attacker could exploit this vulnerability to take control of an affected system.
CISA encourages users and administrators to review the MS-ISAC Advisory 2021-001 and Zyxel Security Advisory for CVE-2020-29583
and apply the necessary updates and mitigation recommendations.
Click to expand...

stapp · Jun 24, 2021

Zyxel Security Incident Alert.

https://support.zyxel.eu/hc/en-us/articles/4402786248466-Security-Incident-Alert-Firewall-Series

Log in or Sign up

Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

guest Guest

Rasheed187 Registered Member

guest Guest

ronjor Global Moderator

stapp Global Moderator

Log in or Sign up

Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

guest Guest

Rasheed187 Registered Member

guest Guest

ronjor Global Moderator

stapp Global Moderator

Useful Searches