Security Experts:

Connect with us

Hi, what are you looking for?



Zyxel Devices Can Be Hacked via DNS Requests, Hardcoded Credentials

Multiple security vulnerabilities have been discovered by SEC Consult in various Zyxel devices, including flaws that involve sending unauthenticated DNS requests and hardcoded FTP credentials.

Multiple security vulnerabilities have been discovered by SEC Consult in various Zyxel devices, including flaws that involve sending unauthenticated DNS requests and hardcoded FTP credentials.

The first issue impacts Zyxel security and networking devices from the USG, UAG, ATP, VPN and NXC products, which are prone to unauthenticated DNS requests, a SEC Consult advisory reads.

The security bug could allow unauthenticated users to check whether a domain is present or not via the web login interface. The IP address is embedded in the response if the host with the corresponding domain is present.

“A DNS request can be made by an unauthenticated attacker to either spam a DNS service of a third party with requests that have a spoofed origin or probe whether domain names are present on the internal network behind the firewall,” the advisory reads.

SEC Consult also discovered that hardcoded FTP credentials are present in multiple Zyxel Wi-Fi access points from the NWA, NAP and WAC series.

With these credentials at hand, an attacker could log on to the APs FTP server and fetch the configuration file that includes SSIDs and passwords, which would allow them to move to protected networks.

“An FTP service runs on the Zyxel wireless access point that contains the configuration file for the WiFi network. This FTP server can be accessed with hardcoded credentials that are embedded in the firmware of the AP. When the WiFi network is bound to another VLAN, an attacker can cross the network by fetching the credentials from the FTP server,” SEC Consult notes.

SEC Consult said it discovered the vulnerabilities in June and reported them to Zyxel at the end of the month. Hotfixes and firmware updates were released at the end of August. For some of the impacted devices, the vendor only released hotfixes, with firmware updates scheduled to be released in the coming months.

Zyxel customers are advised to install the patches and firmware updates for their devices as soon as possible.

SEC Consult’s advisories also include lists with all of the devices impacted by these vulnerabilities.

Related: Verizon Patches Vulnerabilities Affecting Millions of Routers

Related: Crypto Flaw Affects Products From Cisco, Huawei, ZyXEL

Related: Flaws Affecting Top-Selling Netgear Routers Disclosed

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet