Connect with us

Cyber Security

Hackers are exploiting critical bug in Zyxel firewalls and VPNs

Published

on

Hackers have started to exploit a recently patched critical vulnerability, tracked as CVE-2022-30525, that affects Zyxel firewall and VPN devices for businesses.

Successful exploitation allows a remote attacker to inject arbitrary commands remotely without authentication, which can enable setting up a reverse shell.

Getting shell

The vulnerability was discovered by Jacob Baines, lead security researcher at Rapid7, who explains in a brief technical report how the flaw can be leveraged in attacks. A module has been added to the Metasploit penetration testing framework.

“Commands are executed as the nobody user. This vulnerability is exploited through the /ztp/cgi-bin/handler URI and is the result of passing unsanitized attacker input into the os.system method in lib_wan_settings.py” – Jacob Baines

The researcher notes that an attacker can establish a reverse shell using the normal bash GTFOBin.

Setting up a reverse shell after exploiting CVE-2022-30525 bug in Zyxel firewalls and VPNs
source: Rapid7

Zyxel on May 12 released a security advisory for CVE-2022-30525 (9.8 critical severity score), announcing that a fix was released for the affected models and urging administrators to install the latest updates:

Affected modelAffected firmware versionPatch availability
USG FLEX 100(W), 200, 500, 700ZLD V5.00 through ZLD V5.21 Patch 1ZLD V5.30
USG FLEX 50(W) / USG20(W)-VPNZLD V5.10 through ZLD V5.21 Patch 1ZLD V5.30
ATP seriesZLD V5.10 through ZLD V5.21 Patch 1ZLD V5.30
VPN seriesZLD V4.60 through ZLD V5.21 Patch 1ZLD V5.30

The severity of the security issue and the damage it could lead to is serious enough for the NSA Cybersecurity Director Rob Joyce to warn users about exploitation and encourage them to update the device firmware version if it is vulnerable.

Starting Friday the 13th, security experts at the nonprofit Shadowserver Foundation reported seeing exploitation attempts for CVE-2022-30525.

It is unclear if these efforts are malicious or just researchers working to map up Zyxel devices currently exposed to adversary attacks.

Shadowserver noticed CVE-2022-30525 exploitation attempts

Rapid7 scanned the internet for vulnerable Zyxel products and found more than 15,000 using the Shodan search platform for hardware connected to the internet.

Zyxel devices vulnerable to CVE-2022-30525
source: Rapid7

Shadowserver ran their own scan and found at least 20,800 Zyxel firewall models on the open web that are potentially affected by the vulnerability.

The organization counted the hardware by unique IP addresses and discovered that more than 15,000 of them were USG20-VPN and USG20W-VPN, models, designed for “VPN connections across the branch offices and chain stores.”

The region with the most potentially vulnerable devices is the European Union, with France and Italy having the larger number.

Geographic spread of Zyxel devices potentially vulnerable to CVE-2022-30525
source: Shadowserver Foundation

Detecting exploit attempts

Given the severity of the vulnerability and the popularity of the devices, security researchers have released code that should help administrators detect the security flaw and exploitation attempts.

Part of the Spanish telecommunications company Telefónica’s redteam, z3r00t created and published a template for the Nuclei vulnerability scanning solution to detect CVE-2022-30525. The template is available from the author’s GitHub

Another researcher, BlueNinja, also created a script to detect the unauthenticated remote command injection in Zyxel firewall and VPN products and published it on GitHub.

Source: https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-zyxel-firewalls-and-vpns/

Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Copyright © 2023 Cyber Reports Cyber Security News All Rights Reserved Website by Top Search SEO