pwn.watch: Zyxel incident updates

[high] Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)

Tue, 11 Feb 2025 00:00:00 GMT

CVE-2024-40890: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. CVE-2024-40891: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. Added to CISA KEV on 2025-02-11.

Status: closed · Patch: unpatched · Fixed in: None: CISA says the product is end-of-life; discontinue use

Latest updates:

2025-02-11: CISA added CVE-2024-40890 to the KEV catalog (due 2025-03-04).
2025-02-11: CISA added CVE-2024-40891 to the KEV catalog (due 2025-03-04).

CVEs: CVE-2024-40890, CVE-2024-40891

[high] Zyxel Multiple Firewalls Path Traversal

Tue, 03 Dec 2024 00:00:00 GMT

Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-12-03: CISA added CVE-2024-11667 to the KEV catalog (federal deadline 2024-12-24) (source)
2024-11-27: CVE-2024-11667 published (source)

CVEs: CVE-2024-11667

[critical] Zyxel Multiple Network-Attached Storage (NAS) Devices: Command Injection (CVE-2023-27992)

Fri, 23 Jun 2023 00:00:00 GMT

Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. Added to CISA KEV on 2023-06-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-23: CISA added CVE-2023-27992 to the KEV catalog (due 2023-07-14).

CVEs: CVE-2023-27992

[critical] Zyxel Multiple Firewalls: 2 exploited vulnerabilities (CVE-2023-33009, CVE-2023-33010)

Mon, 05 Jun 2023 00:00:00 GMT

Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. Added to CISA KEV on 2023-06-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-05: CISA added CVE-2023-33009 to the KEV catalog (due 2023-06-26).
2023-06-05: CISA added CVE-2023-33010 to the KEV catalog (due 2023-06-26).

CVEs: CVE-2023-33009, CVE-2023-33010

[critical] Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)

Wed, 31 May 2023 00:00:00 GMT

Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. Added to CISA KEV on 2023-05-31.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-31: CISA added CVE-2023-28771 to the KEV catalog (due 2023-06-21).

CVEs: CVE-2023-28771