USG40's VPN VOIP Stopped Working

RDVasil said:

We have USG40's at a branch and main office connected to each other by IPSEC VPN.  Have VOIP phones at branch office and phone system controller at main office.  Worked fine for months but stopped working three days ago.  No changes made to either router, both running 4.63 firmware. 

VPN is working - computers on either side can see each other, ping and RDP work in both directions, computers at branch office can access file server at main office. 

The only problem is the phones - callers at branch office can make calls but cannot hear - no audio comes in.  Wireshark shows audio, which should be coming in on UDP ports 10020-10050, is not coming in, but on the main office side Wireshark shows audio is being transmitted.

My understanding is that all tunnel traffic should be enabled by default.  I've manually added policy to allow all traffic to/from the telephone controller at the main office to no avail.
Question - if I briefly turn off Policy Control on both routers, will that enable all traffic - and if the phones start working again, would that verify a policy issue?  Or, am I missing something else?

Dear Customer, We recently became aware of a sophisticated threat actor targeting a small subset of Zyxel security appliances that have remote management or SSL VPN enabled, namely in the USG/ZyWALL, USG FLEX, ATP, and VPN series running on-premise ZLD firmware. Those running the Nebula cloud management mode are not affected. We’re aware of the situation and have been working our best to investigate and resolve it. The threat actor attempts to access a device through WAN; if successful, they then bypass authentication and establish SSL VPN tunnels with unknown user accounts, such as“zyxel_sllvpn”, “zyxel_ts”, or “zyxel_vpn_test”, to manipulate the device’s configuration. Based on our investigation so far, we believe maintaining a proper security policy for remote access is currently the most effective way to reduce the attack surface; therefore, we strongly recommend that you follow the guidance and the SOP below: 1. Unless you must manage devices from the WAN side, disable HTTP/HTTPS services from WAN. 2. If you still need to manage devices from the WAN side: • enable Policy Control and add rules to only allow access from trusted source IP addresses; and • enable GeoIP filtering to only allow access from trusted locations.