PT-2023-3605 · Zyxel · Zyxel Atp Series+4

Atdog + 1 · Publicado 2023-05-17 · Atualizado 2024-02-21 · CVE-2023-33012

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel USG FLEX series firmware versions 5.00 through 5.36 Patch 2 Zyxel USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2 Zyxel USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2 Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2 Zyxel VPN series firmware versions 5.00 through 5.36 Patch 2

Description The issue is related to a command injection vulnerability in the configuration parser of the affected Zyxel devices. This vulnerability can be exploited by an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled. The exploitation occurs during an attempted ip addr command, and the order of operations is important for successful exploitation. It is estimated that out of approximately 7,600 devices using vulnerable firmware, around 607 were using the vulnerable configuration.

Recommendations For Zyxel USG FLEX series firmware versions 5.00 through 5.36 Patch 2, update to a version later than 5.36 Patch 2. For Zyxel USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2. For Zyxel USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2. For Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, update to a version later than 5.36 Patch 2. For Zyxel VPN series firmware versions 5.00 through 5.36 Patch 2, update to a version later than 5.36 Patch 2. As a temporary workaround, consider disabling the cloud management mode until a patch is available. Restrict access to the GRE configuration to minimize the risk of exploitation. Avoid using the proto vti configuration option in the affected API endpoint until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-03888

CVE-2023-33012

Produtos afetados

Zyxel Atp Series

Zyxel Usg Flex 50(W) Series

Zyxel Usg Flex Series

Zyxel Usg20(W)-Vpn Series

Zyxel Vpn Series

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zyxel_parse_config_rce.rb · Exploit
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers · Aviso do Fabricante
• https://t.me/cvenotify/54519 · Publicação no Telegram
• https://twitter.com/autumn_good_35/status/1760349685834031389 · Publicação no Twitter
• https://t.me/thebugbountyhunter/8376 · Publicação no Telegram
• https://vuldb.com/ru/?id.234336 · Nota
• https://t.me/cvenotify/55251 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33012 · Nota de Segurança
• https://t.me/secharvester/15474 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33012 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03888 · Nota de Segurança