Zyxel security advisory for command injection vulnerability of firewalls

Zyxel_Charlie

Summary

Zyxel has released updates for a command injection vulnerability recently reported by Chaitin Security Research Lab. Users are advised to install the updates for optimal protection.

What is the vulnerability?

A command injection vulnerability was identified in the “chg_exp_pwd” CGI program on some Zyxel security firewalls. The lack of input string sanitization in the CGI program could allow an attacker to inject commands if they successfully log in as the admin and attempt to change the password using the vulnerable CGI.

What products are vulnerable—and what should you do?

After a thorough investigation of our product lines, we’ve identified the vulnerable products that are within their warranty and support period and released patches to address the issue, as shown in the table below. For optimal protection, we urge users to install the applicable updates.

*Please reach out to your local Zyxel support team for the file.

**Firmware update available on Nebula Control Center (NCC) at https://nebula.zyxel.com/.

Contact your local Zyxel support team if you require further assistance.  

Got a question or a tipoff?

Please contact your local service rep for further information or assistance. If you’ve found a vulnerability, we want to work with you to fix it—contact security@zyxel.com.tw and we’ll get right back to you.

Acknowledgment

Thanks to swing & leommxj of Chaitin Security Research Lab for reporting the issues to us.

Revision history

2020-11-23: Initial release