Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Major Security Flaws in Zyxel Firewalls, Access Points, NAS Devices

Zyxel patches at least 15 security flaws that expose users to authentication bypass, command injection and denial-of-service attacks.

Taiwanese networking device vendor Zyxel has posted security warnings for major vulnerabilities haunting users of its firewalls, access points and network access storage (NAS) devices.

Zyxel, a company that has struggled with software security problems, documented at least 15 security flaws in a range of products and warned that unpatched devices are at risk of authentication bypass, command injection and denial-of-service attacks.

The company is calling special attention to exposed attack surfaces in its firewalls and access points, warning that multiple devices can be exploited to access configuration files, steal sensitive cookies, launch denial-of-service conditions or execute commands.

In some cases, Zyxel said its firewalls and access points could allow an authenticated local attacker to modify the URL of the registration page in the web GUI of an affected device or access the administrator’s logs on an affected device.

The hardware vendor also shipped a second bulletin to warn of authentication bypass vulnerability and command injection vulnerabilities in two NAS (network attached storage) products.

In all, Zyxel documented six separate flaws in the NAS226 and NAS542 cloud storage devices, noting that attackers can exploit the flaws to capture sensitive system information or execute some operating system (OS) commands via booby-trapped URLs.

Security defects in Zyxel products feature prominents in the CISA KEV (Known Exploited Vulnerabilities) catalog and the company has acknowledged its devices have been ensnared in multiple DDoS-capable botnets.

Related: Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities

Advertisement. Scroll to continue reading.

Related: Multiple DDoS Botnets Exploiting Recent Zyxel Vulnerability

Related: Critical Vulnerability in Zyxel Firewalls Leads to Command Execution

Related: Zyxel Warns Customers of Attacks on Security Appliances

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.