Authentication Bypass Vulnerability in Zyxel Firmware

THREAT LEVEL: Amber For a detailed advisory, download the pdf file here A severe vulnerability (CVE-2022-0342) has been discovered in the firmware of some of Zyxel's business-grade firewall and VPN products, potentially allowing attackers administrator-level access to affected devices. This vulnerability affects the USG/ZyWALL, USG FLEX, ATP, VPN, and NSG (Nebula Security Gateway) range of Zyxel products. This is an authentication bypass vulnerability (CVE-2022-0342) discovered in the CGI program of some firewall versions due to a lack of a proper access control mechanism. An attacker could use this flaw to circumvent authentication and get administrative access to the device. For optimal protection, we suggest organizations to update the firmware of their products according to the information given below. Potential MITRE ATT&CK TTPs are: TA0001: Initial Access TA0002: Execution TA0004: Privilege Escalation TA0005: Defense Evasion TA0006: Credential Access TA0007: Discovery TA0042: Resource Development T1040: Network Sniffing T1588: Obtain Capabilities T1588.006: Obtain Capabilities: Vulnerabilities T1548: Abuse Elevation Control Mechanism T1190: Exploit Public-Facing Application Vulnerability Details Affected Products Patch Links https://support.zyxel.eu/hc/en-us/articles/4672704562578-USG-FLEX-ATP-Series-Firmware-Update-5-21-Patch-1-Installation-Notes References https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml