Critical Privilege Escalation Vulnerability Discovered In Zyxel Firewall

Safety researchers found a critical vulnerability within the Zyxel Firewall, permitting for native privilege escalation. Nonetheless, a distant attacker may additionally exploit the flaw, including to the severity of the problem. Fortunately, Zyxel patched the vulnerability following the report, avoiding any malicious exploitation.

Zyxel Firewall Vulnerability

Elaborating their findings in a current put up, Rapid7 researchers talked about how they discovered a neighborhood privilege escalation vulnerability affecting the Zyxel firewall. In accordance with the researchers, the merchandise affected by this vulnerability embody,

• USG FLEX 100, 100W, 200, 500, 700
• USG20-VPN, USG20W-VPN
• ATP 100, 200, 500, 700, 800
• VPN 50, 100, 300, 1000

These firewalls usually intention at serving company clients, providing e-mail safety, internet filtering, SSL inspection, intrusion safety, and VPN.

Particularly, the vulnerability for allowed a low-privileged authenticated person to achieve root entry on the right track gadgets. Triggering the vulnerability includes exploiting the zysudo.suid binary, which permits a low-privileged person to execute totally different permitted (allow-list) instructions. The researchers observed that many of those instructions permit command injection and arbitrary file-write to the customers. However one such file root: /var/zyxel/crontab was of main concern because it allowed an attacker to achieve root entry.

Describing the PoC exploit, the researchers acknowledged,

The attacker copies the energetic crontab to /tmp/. Then they use echo to create a brand new script known as /tmp/exec_me. The brand new script, when executed, will begin a reverse shell to 10.0.0.28:1270. Execution of the brand new script is appended to /tmp/crontab. Then /var/zyxel/crontab is overwritten with the malicious /tmp/crontab utilizing zysudo.suid. cron will execute the appended command as root inside the subsequent 60 seconds.

Whereas the vulnerability apparently facilitates native customers, the researchers defined {that a} distant attacker may additionally exploit the flaw. Doing so merely required the attacker to use one other associated flaw, just like the CVE-2022-30525.

Patch Deployed

Following this discovery, the researchers reached out to Zyxel officers. In response, the distributors patched the vulnerability throughout a number of merchandise.

As elaborated in Zyxel’s advisory, the distributors patched this vulnerability along with one other flaw CVE-2022-2030. The advisory additionally lists the small print in regards to the patched firmware variations that customers can seek advice from replace their gadgets accordingly.

Tell us your ideas within the feedback.