Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices.

The flaw, tracked as CVE-2020-29583 (CVSS score 7.8), affects version 4.60 present in wide-range of Zyxel devices, including Unified Security Gateway (USG), USG FLEX, ATP, and VPN firewall products.

EYE researcher Niels Teusink reported the vulnerability to Zyxel on November 29, following which the company released a firmware patch (ZLD V4.60 Patch1) on December 18.

According to the advisory published by Zyxel, the undocumented account (“zyfwp”) comes with an unchangeable password (“PrOw!aN_fXp“) that’s not only stored in plaintext but could also be used by a malicious third-party to login to the SSH server or web interface with admin privileges.

Zyxel said the hardcoded credentials were put in place to deliver automatic firmware updates to connected access points through FTP.

Noting that around 10% of 1000 devices in the Netherlands run the affected firmware version, Teusink said the flaw’s relative ease of exploitation makes it a critical vulnerability.

“As the ‘zyfwp‘ user has admin privileges, this is a serious vulnerability,” Teusink said in a write-up. “An attacker could completely compromise the confidentiality, integrity and availability of the device.”

“Someone could for example change firewall settings to allow or block certain traffic. They could also intercept traffic or create VPN accounts to gain access to the network behind the device. Combined with a vulnerability like Zerologon this could be devastating to small and medium businesses.”

The Taiwanese company is also expected to address the issue in its access point (AP) controllers with a V6.10 Patch1 that’s set to be released in April 2021.

It’s highly recommended that users install the necessary firmware updates to mitigate the risk associated with the flaw.

Technology

Products You May Like

Articles You May Like

Samsung Galaxy Tab S8 FE Tipped to Sport LCD Screen With Stylus Support
iQoo 11 5G Launch Date Set for December 2, to Feature Snapdragon 8 Gen 2 SoC: Report
Charles Koppelman Dies: Hit-Making Record Executive And Martha Stewart Living Chairman Was 82
The Best Unexpected Board Books To Gift
Tampax accused of ‘sexualising women’ after controversial tweet goes viral

Leave a Reply

Your email address will not be published.