Firmware update checksum

mingk

I downloaded USG40_V4.35(AALA3)C0 last night but the checksum on the landing page did NOT match the file I received. Today I cannot find a checksum for the above file on the landing page.

The file I downloaded has the following checksums:

SHA-1 538a7d692baaad55f2c0bfbfbc225aeb2ed1ed02

SHA-256 d3c0ec2aeb182ee5b427bccdefc00c7b49678ab210a32b3ba4d232d2b12af7d6

Can someone confirm the integrity of the file I've downloaded.

Thanks.

Zyxel_Jerry

Hi @mingk

Welcome to Zyxel community

Here is the download link of USG40

https://www.zyxel.com/support/DownloadLandingSR.shtml?c=gb&l=en&kbid=M-01438&md=USG40#searchZyxelTab1

The checksum SHA-1 is the same with yours,

Could you share "the checksum on the landing page did NOT match the file" with us ?

Zyxel_Jerry

Hi @mingk

Welcome to Zyxel community

Here is the download link of USG40

https://www.zyxel.com/support/DownloadLandingSR.shtml?c=gb&l=en&kbid=M-01438&md=USG40#searchZyxelTab1

The checksum SHA-1 is the same with yours,

Could you share "the checksum on the landing page did NOT match the file" with us ?

mingk

Thanks Jerry.

The path I took to the USG40 firmware download was:

CVE to Zyxel advisory and the download link for the USG40 firmware on that page

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9054

https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml

https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01438&md=USG40

I see that the checksum posted now corresponds to the file I have but it was not the case when I first downloaded the file at around 2100 PST on 4th March, it gave a different checksum.

When I tried again yesterday before posting the question there were no link for the checksum.