-1.svg){kind=logo}
Threat actors are exploiting a vulnerability found in a firewall widely used in small and medium businesses. Here's what you need to know.
Background
On May 12, 2022, Zyxel disclosed a critical vulnerability, CVE-2022-30525, affecting Zyxel products. This vulnerability allows unauthenticated and remote attackers to execute code on affected devices. The Zyxel firewall series performs VPN connectivity, SSL inspection, web filtering, intrusion protection, and email security and are widely used in small to medium businesses. The firewall series that are affected offers a feature known as Zero Touch Provisioning (ZTP), which includes the ATP series, VPN series, and the USG FLEX series (including USG20-VPN and USG20W-VPN).
Quick facts: what you need to know now
- Attackers are actively exploiting the vulnerability in affected devices.
- This vulnerability has a CVSS score of 9.8 — indicating a high severity.
- Exploitation of the vulnerability allows an attacker to execute remote commands and modify files on the device leading to the compromise of the device and unauthorized access into the environment as the firewall controls incoming and outgoing traffic to your network.
Next Steps for All Zyxel Customers:
- Determine if your organization is using one of the impacted Zyxel firewalls. They are listed below:
|
Affected Model |
Affected Firmware Version |
|
USG FLEX 100(W), 200, 500, 700 |
ZLD V5.00 through ZLD V5.21 Patch 1 |
|
USG FLEX 50(W) / USG20(W)-VPN |
ZLD V5.00 through ZLD V5.21 Patch 1 |
|
ATP series |
ZLD V5.00 through ZLD V5.21 Patch 1 |
|
VPN series |
ZLD V5.00 through ZLD V5.21 Patch 1 |
- Update the devices to the latest patch, ZLD V5.30.
- If possible, enable automatic firmware updates.
- Disable WAN access to the administrative web interface of the system.
Resources
- Rapid7 Blog: https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/
- Zyxel Security Advisory: https://www.zyxel.com/us/en/support/Zyxel-security-advisory-for-OS-command-injection-vulnerability-of-firewalls.shtml
- Ars Technica: https://arstechnica.com/information-technology/2022/05/zyxel-silently-patches-command-injection-vulnerability-with-9-8-severity-rating/
If you have any questions, please reach out to the Risk + Response Team at services@corvusinsurance.com!