Newest security incident (Remote mng, SSL VPN)

kyssling

Hello , are we affected by latest security incident with FW V4.62(AAPH.0)ITS-WK02-r98140 or this security problem is only with  ZLD firmware for USG110 ?

mMontana

I had some verifications among different devices (USG20-VPN, USG20W-VPN, USG40, USG60, USG60W) and i found unwanted users.

For all devices, firmware version 4.63 (not the latest one, according to this topic)

Zyxel_Stanley

Hi @kyssling
Based on our investigation so far, a small subset of Zyxel security appliances is targeted. Currently we haven’t observed any direct correlation with specific firmware versions. The most effective way is to check if there is any unknown SSL VPN user account, such as “zyxel_sllvpn”, “zyxel_ts”, or “zyxel_vpn_test”, has been created. If not, your device is not affected, and please follow the mitigations below as a precaution.

https://community.zyxel.com/en/discussion/10912/how-to-mitigate-the-threat-by-limiting-the-access-sources#latest