ZLD4.64 & 5.01 Firmware release

2

All Replies

  • Zyxel_Vic
    Zyxel_Vic Posts: 282  Zyxel Employee
    25 Answers First Comment Friend Collector Seventh Anniversary
    Hi @kyssling, @Sconsulting, @Asgatlat

    This is the mitigation firmware which we believe that the implemented method will be able to provide the best practice to protect your network.

    Hi @OTADMIN

    If you're using 2FA as the auth method, the HTTPS service from WAN port can't be disabled since 2FA will implement it for the authentication. Thanks for your feedback, this improvement is now under discussion and we had put it in our plan. However, it is still suggested to upgrade 4.64 (or 5.01) with GeoIP implementation which can limit the authorized people from the specified regions. In addition, it will be a good general practice in security if the passwords can be changed periodically as well


  • Mario
    Mario Posts: 106  Ally Member
    Zyxel Certified Network Engineer Level 1 - Security First Comment Friend Collector Fifth Anniversary
    @USG_User thanks for the feedback. I know this is possible, but all users need to change this.
    During homeoffice, this generates a lot of trouble till all user connect to the new port. And somtimes other prots then 80/443 are blocked. Cause Zyxel suggest only to seperate HTTPS and SSL VPN, but don't make a recomendation about the ports.
  • travisb
    travisb Posts: 10  Freshman Member
    First Comment Second Anniversary
    Guide if it doesn't already should include changing of admin account passwords. We are seeing devices with new user objects (random names none of the test accounts) and then the same IP using the default admin account.
  • EricNepean2
    EricNepean2 Posts: 6
    Friend Collector
    edited June 2021
    Zyxel_Vic said:
    Hi @kyssling, @Sconsulting, @Asgatlat
    .......
    If you're using 2FA as the auth method, the HTTPS service from WAN port can't be disabled since 2FA will implement it for the authentication. Thanks for your feedback, this improvement is now under discussion and we had put it in our plan. ....
    .......
    The operational issue I still see with 2FA is that if your WAN connection is down, 2FA will not work, preventing admin access to the Zyxel device. Now it becomes more difficult to discover why your network is down.

  • mMontana
    mMontana Posts: 1,389  Guru Member
    50 Answers 1000 Comments Friend Collector Fifth Anniversary
    mMontana said:
    Thanks Zyxel for giving the customers some tools for mitigate  risk and reduce footprint of attack.
    But my customers are asking and i have to turn the question to you.
    @Zyxel_Stanley, i am writing to you but of course there's nothing personal about that :-)

    1. Has the attack tecnique been thoroughly analyzed?
    2. Was found the way for the attackers to create users on the devices?
    3. Is this (eventual) way being originated from a vulnerability of the software, shared among versions 4.x and 5.x?
    4. Has this (again, eventual) vulnerability been found and patched?
    5. Is there any eventual ETA for deliver to customers stable and effective patch?
    6. Is there a way to assess if the firewall has been compromised?
    7. Can configuration backups on the device be considered safe or assessed as compromised?
    8. Is there a way to assess the security the device different than a full-manual reconfigure?
    Moreover...

    I am not expert of using GeoIP feature. And as far as i can see, I not usire if I can"feed" a host group by nations/contintents outside the wizard.

    Is there a part into user manual which cover how to create rules with GeoIP objects and references?
    I did not forgot my questions. I am aware that might take some time to have answers.
    Still a Security Advisory not released. But I won't stop reminding that it will be due to customers, when all the pieces will be put together.
  • itxnc
    itxnc Posts: 98  Ally Member
    First Comment Friend Collector Sixth Anniversary
    EricNepean2 said:
    Zyxel_Vic said:
    Hi @kyssling, @Sconsulting, @Asgatlat
    .......
    If you're using 2FA as the auth method, the HTTPS service from WAN port can't be disabled since 2FA will implement it for the authentication. Thanks for your feedback, this improvement is now under discussion and we had put it in our plan. ....
    .......
    The operational issue I still see with 2FA is that if your WAN connection is down, 2FA will not work, preventing admin access to the Zyxel device. Now it becomes more difficult to discover why your network is down.

    We've switched over to Google Authenticator (we actually use Authy) for admin access for this very reason. 
  • mMontana
    mMontana Posts: 1,389  Guru Member
    50 Answers 1000 Comments Friend Collector Fifth Anniversary
    I'm still waiting Zyxel like a Romeo waits his Juliet... My Wishing Well contains a wish for a patched (not mitigated) firmware... ;)
  • sorin
    sorin Posts: 2
    Friend Collector Second Anniversary
    According to Zyxel support:
    "The firmware you downloaded currently offers license-free GeoIP feature to mitigate the damage as much as possible. However patch that would fix this vulnerability is expected to arrive during next week."
    So, stay strong till next week!
  • sorin
    sorin Posts: 2
    Friend Collector Second Anniversary
    EricNepean2 said:
    Zyxel_Vic said:
    Hi @kyssling, @Sconsulting, @Asgatlat
    .......
    If you're using 2FA as the auth method, the HTTPS service from WAN port can't be disabled since 2FA will implement it for the authentication. Thanks for your feedback, this improvement is now under discussion and we had put it in our plan. ....
    .......
    The operational issue I still see with 2FA is that if your WAN connection is down, 2FA will not work, preventing admin access to the Zyxel device. Now it becomes more difficult to discover why your network is down.

    Configure one admin account with Google 2FA and you will get 5 backup codes that will work even if the WAN is down and/or you don't have access to your phone.
  • mMontana
    mMontana Posts: 1,389  Guru Member
    50 Answers 1000 Comments Friend Collector Fifth Anniversary
    edited July 2021
    I'm not pleased for not see any status update of the (eventual) vulnerability and the (eventual) firmware upgrade for solving "once for all" the issue encountered about security incident.

    GeoIP and HTTPS port split among admin interface and SSL VPN are a really useful tools, but they are not the solution, only mitigation.

    My users are asking updates, about how and when their devices well become safer.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）