Zyxel Fixes 0day in Network Storage Devices

guest · Feb 24, 2020

Zyxel Fixes 0day in Network Storage Devices
February 24, 2020
https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/

Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground.

KrebsOnSecurity first learned about the flaw on Feb. 12 from Alex Holden, founder of Milwaukee-based security firm Hold Security. Holden had obtained a copy of the exploit code, which allows an attacker to remotely compromise more than a dozen types of Zyxel NAS products remotely without any help from users.

Earlier today, Zyxel sent a message saying it had published a security advisory and patch for the zero-day exploit in some of its affected products.
The flaw is designated as CVE-2020-9054.
Click to expand...

guest · Feb 25, 2020

ZyXEL NAS pre-authentication command injection in weblogin.cgi
Vulnerability Note VU#498544
February 24, 2020
https://kb.cert.org/vuls/id/498544/

Overview
Multiple ZyXEL network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device.
Description
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. [...]
Impact
By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker.
Click to expand...

guest · Mar 20, 2020

New Mirai Variant ‘Mukashi’ Targets Zyxel NAS Devices
The botnet exploits a vulnerability discovered last month
March 20, 2020
https://threatpost.com/new-mirai-variant-mukashi-targets-zyxel-nas-devices/153982/

The variant, dubbed Mukashi, takes advantage of a pre-authentication command injection vulnerability found in Zyxel NAS storage devices, according to researchers at Palo Alto Networks’ Unit 42 global threat intelligence team. A proof of concept for the vulnerability, CVE-2020-9054, was published publicly only last month.

“Mukashi brute forces the logins using different combinations of default credentials, while informing its command and control (C2) server of the successful login attempts,” Unit 42 Ken Hsu, Zhibin Zhang and Ruchna Nigam wrote in a blog post published Thursday.
Many and potentially all Zyxel NAS products running firmware versions up to 5.21 are vulnerable to compromise, they said.
Click to expand...

Zyxel has published a vendor advisory on the vulnerability as well as a website for testing whether a device is vulnerable.
Click to expand...

Palo Alto Networks - Unit42: New Mirai Variant Targets Zyxel Network-Attached Storage Devices

This vulnerability has a critical rating (i.e CVSS v3.1 score of 9.8) due to its trivial-to-exploit nature. It’s not surprising that the threat actors weaponize this vulnerability and start wreaking havoc in the Internet of Things (IoT) realm. It was initially discovered via the sale of its exploit code as a 0-day i.e. while it was still unreported to the vendor.
Click to expand...

ronjor · Mar 20, 2020

Flaw Powers New Mirai IoT Botnet Strain

20 March 2020
In February, hardware maker Zyxel fixed a zero-day vulnerability in its routers and VPN firewall products after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of Mirai, a malware strain that targets vulnerable Internet of Things (IoT) devices for use in large-scale attacks and as proxies for other cybercrime activity.
Click to expand...

https://krebsonsecurity.com/2020/03/zxyel-flaw-powers-new-mirai-iot-botnet-strain/

Log in or Sign up

Zyxel Fixes 0day in Network Storage Devices

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Zyxel Fixes 0day in Network Storage Devices

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches