Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Hackers Exploiting Recently Disclosed Zyxel Vulnerability

Security researchers have observed the first attempts to compromise Zyxel devices using a recently disclosed vulnerability related to the existence of hardcoded credentials.

Security researchers have observed the first attempts to compromise Zyxel devices using a recently disclosed vulnerability related to the existence of hardcoded credentials.

The attacks, currently small in numbers, target CVE-2020-29583, a vulnerability affecting several Zyxel firewalls and WLAN controllers that was publicly disclosed at the end of December.

Firmware updates that remove the bug are already available for some of the affected products, but attackers are seizing the moment, attempting to find vulnerable devices before patches have been applied.

Discovered by EYE security researchers, the issue impacts Zyxel USG, ATP, VPN, ZyWALL, and USG FLEX devices and exists because the password for the undocumented user account zyfwp is stored in the firmware in plaintext.

The account is meant for the automatic delivery of firmware updates over FTP and has admin privileges. Thus, attacks targeting vulnerable devices could lead to the compromise of entire networks, researchers warn.

Starting January 3, security researchers at GreyNoise, a company that collects and analyzes Internet-wide scan and attack data, observed the first attempts to exploit this so-called “backdoor account” on Zyxel devices, and they say the attacks do not appear to be targeted in nature, but rather opportunistic.

“Yesterday we saw one device start opportunistically attempting to login to servers on the internet over SSH using the ‘backdoor’ username and password disclosed by Zyxel for CVE-2020-29583. Today, we saw two more, bringing us to a total of three (3) devices,” GreyNoise founder Andrew Morris told SecurityWeek via email.

Zyxel exploit

While these are clear attempts to find and compromise vulnerable Zyxel devices that are exposed to the Internet, attribution is not as straightforward.

Advertisement. Scroll to continue reading.

“One or more individuals, groups, organizations, or botnet operators” could be behind the attempts, Morris pointed out.

Related: Hardcoded Credentials Expose Zyxel Firewalls, WLAN Controllers to Remote Attacks

Related: Over 20 Zyxel Firewalls Impacted by Recent Zero-Day Vulnerability

Related: Many Backdoors Found in Zyxel CloudCNM SecuManager Software

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Kenna Security co-founder Ed Bellis has joined Empirical Security as Chief Executive Officer.

Robert Shaker II has joined application security firm ActiveState as Chief Product and Technology Officer.

MorganFranklin Cyber has promoted Nick Stallone and Ferdinand Hamada into newly created roles.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.