Zyxel warns of vulnerabilities in a wide range of its products

Networking hardware-maker Zyxel is warning of almost a dozen vulnerabilities in a big selection of its merchandise. If left unpatched, a few of them may allow the entire takeover of the units, which will be focused as an preliminary level of entry into giant networks.

Probably the most severe vulnerability, tracked as CVE-2024-7261, will be exploited to “permit an unauthenticated attacker to execute OS instructions by sending a crafted cookie to a weak machine,” Zyxel warned. The flaw, with a severity score of 9.8 out of 10, stems from the “improper neutralization of particular components within the parameter ‘host’ within the CGI program” of weak entry factors and safety routers. Practically 30 Zyxel units are affected. As is the case with the remaining vulnerabilities on this publish, Zyxel is urging clients to patch them as quickly as attainable.

However wait… there’s extra

The {hardware} producer warned of seven extra vulnerabilities affecting firewall sequence together with the ATP, USG-FLEX, and USG FLEX 50(W)/USG20(W)-VPN. The vulnerabilities carry severity rankings starting from 4.9 to eight.1. The vulnerabilities are:

CVE-2024-6343: a buffer overflow vulnerability within the CGI program that would permit an authenticated attacker with administrator privileges to wage denial-of-service by sending crafted HTTP requests.

CVE-2024-7203: A post-authentication command injection vulnerability that would permit an authenticated attacker with administrator privileges to run OS instructions by executing a crafted CLI command.

CVE-2024-42057: A command injection vulnerability within the IPSec VPN characteristic that would permit an unauthenticated attacker to run OS instructions by sending a crafted username. The assault would achieve success provided that the machine was configured in Consumer-Primarily based-PSK authentication mode and a legitimate consumer with a protracted username exceeding 28 characters exists.

CVE-2024-42058: A null pointer dereference vulnerability in some firewall variations that would permit an unauthenticated attacker to wage DoS assaults by sending crafted packets.

CVE-2024-42059: A post-authentication command injection vulnerability that would permit an authenticated attacker with administrator privileges to run OS instructions on an affected machine by importing a crafted compressed language file through FTP.

CVE-2024-42060: A post-authentication command injection vulnerability that would permit an authenticated attacker with administrator privileges to execute OS instructions by importing a crafted inner consumer settlement file to the weak machine.

CVE-2024-42061: A mirrored cross-site scripting vulnerability within the CGI program “dynamic_script.cgi” that would permit an attacker to trick a consumer into visiting a crafted URL with the XSS payload. The attacker may get hold of browser-based data if the malicious script is executed on the sufferer’s browser.

The remaining vulnerability is CVE-2024-5412 with a severity score of seven.5. It resides in 50 Zyxel product fashions, together with a variety of buyer premises gear, fiber optical community terminals, and safety routers. A buffer overflow vulnerability within the “libclinkc” library of affected units may permit an unauthenticated attacker to wage denial-of-service assaults by sending a crafted HTTP request.

Lately, vulnerabilities in Zyxel units have repeatedly come underneath active attack. Lots of the patches can be found for obtain at hyperlinks listed within the advisories. In a small variety of circumstances, the patches can be found via the cloud. Patches for some merchandise can be found solely by privately contacting the corporate’s help group.