ATP500 Connection refused via web

ITS

Hi,
I've got an ATP500, this morning I've tried to logon via web. Connection refused. I tried to logon via SSH, no problem. I've tried to reboot. Connection refued. I've Update ATP500 via ssh to ATP500_V5.30(ABFU.0)C0, nothing changed. I cannot use web GUI. Any suggestion?
Thanks.
Bye

Fred_77

Hi @ITS

same issue this morning on ATP200.
With Surprise i've found this configuration:





So i was able to connect to web gui with port 4337 (changed not by me)




... OK i've got back the management of the device, but now i've to understand what happened..

Hope this can help

Fred

Fred_77

Hi @ITS

same issue this morning on ATP200.
With Surprise i've found this configuration:





So i was able to connect to web gui with port 4337 (changed not by me)




... OK i've got back the management of the device, but now i've to understand what happened..

Hope this can help

Fred

Zyxel_James

Hello @ITS, @Fred_77,

Recently, we noticed there is some footprint of CVE-2022-30525 on the customer's device.

There are two symptoms, please check if you encounter this problem.

1. Add an new admin user named "zyxelmd"

2. Change web access https port to 4337

 

Please the follow the steps below to avoid attack.

STEP1. To delete the weird user account, especially "zyxelmd", and change all the current user's password.

 

STEP2. To update to 5.30 later firmware.

The 5.30 firmware fix CVE-2022-30525, you may refer to the link below

https://community.zyxel.com/en/discussion/13414/zyxel-security-advisory-for-os-command-injection-vulnerability-of-firewalls#latest

 

STEP3. To enhance their web access login policy, please refer to the below link:

https://community.zyxel.com/en/discussion/10920/best-practices-to-secure-a-distributed-network-infrastructure

https://community.zyxel.com/en/discussion/10912/how-to-mitigate-the-threat-of-the-security-incident

 

Thanks,

James

Fred_77

Hi @Zyxel_James

my intention was indeed to apply fw 5.30 patch released a couple of days ago... 
I preferred to wait to apply the previous 5.30 due to reported SSL VPN issues.

Web access was already filtered...

What to say... this time i arrived late.

Thanks
Fred

ITS

Zyxel_James said:

Hello @ITS, @Fred_77,

STEP1. To delete the weird user account, especially "zyxelmd", and change all the current user's password.

 

Many thanks, now I can access. 

All suggestion applied.
@Fred_77 Thanks also to you!
Bye