PT-2020-15889 · Zyxel · Zyxel Utm/Vpn

Published 2020-11-27 · Updated 2024-12-12 · CVE-2020-25014

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zyxel UTM and VPN series of gateways versions V4.30 through V4.55

Description A stack-based buffer overflow in fbwifi continue.cgi allows remote unauthenticated attackers to execute arbitrary code via a crafted HTTP packet. This issue affects Zyxel UTM and VPN series of gateways, enabling attackers to potentially gain control over the device.

Recommendations For versions V4.30 through V4.55, update the firmware to a version that is not affected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-25014

Affected Products

Zyxel Utm/Vpn

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-25014 · Security Note
• https://zyxel.com/support/Zyxel-security-advisory-for-buffer-overflow-vulnerability.shtml · Vendor Advisory
• https://businessforum.zyxel.com/categories/security-news-and-release · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25014 · Vendor Advisory
• https://t.me/cibsecurity/16897 · Telegram Post
• https://t.me/cibsecurity/17442 · Telegram Post