ATP500 Connection refused via web

ITS · May 2022

Hi,
I've got an ATP500, this morning I've tried to logon via web. Connection refused. I tried to logon via SSH, no problem. I've tried to reboot. Connection refued. I've Update ATP500 via ssh to ATP500_V5.30(ABFU.0)C0, nothing changed. I cannot use web GUI. Any suggestion?
Thanks.
Bye

Fred_77 · May 2022

Hi @ITS

same issue this morning on ATP200.
With Surprise i've found this configuration:

Image: https://us.v-cdn.net/6029482/uploads/editor/6s/9oxfa01sop43.png

Image: https://us.v-cdn.net/6029482/uploads/editor/jw/eytqlgyl4pk7.png

So i was able to connect to web gui with port 4337 (changed not by me)

Image: https://us.v-cdn.net/6029482/uploads/editor/yi/lvh1w4hn1316.png

... OK i've got back the management of the device, but now i've to understand what happened..

Hope this can help

Fred

Fred_77 · May 2022

Hi @ITS

same issue this morning on ATP200.
With Surprise i've found this configuration:

So i was able to connect to web gui with port 4337 (changed not by me)

... OK i've got back the management of the device, but now i've to understand what happened..

Hope this can help

Fred

Zyxel_James · May 2022

Hello @ITS, @Fred_77,

Recently, we noticed there is some footprint of CVE-2022-30525 on the customer's device.

There are two symptoms, please check if you encounter this problem.

1. Add an new admin user named "zyxelmd"

2. Change web access https port to 4337

Please the follow the steps below to avoid attack.

STEP1. To delete the weird user account, especially "zyxelmd", and change all the current user's password.

STEP2. To update to 5.30 later firmware.

The 5.30 firmware fix CVE-2022-30525, you may refer to the link below

https://community.zyxel.com/en/discussion/13414/zyxel-security-advisory-for-os-command-injection-vulnerability-of-firewalls#latest

STEP3. To enhance their web access login policy, please refer to the below link:

https://community.zyxel.com/en/discussion/10920/best-practices-to-secure-a-distributed-network-infrastructure

https://community.zyxel.com/en/discussion/10912/how-to-mitigate-the-threat-of-the-security-incident

Thanks,

James

Fred_77 · May 2022

Hi @Zyxel_James

my intention was indeed to apply fw 5.30 patch released a couple of days ago...
I preferred to wait to apply the previous 5.30 due to reported SSL VPN issues.

Web access was already filtered...

What to say... this time i arrived late.

Thanks
Fred

ITS · May 2022

Zyxel_James said:

Hello @ITS, @Fred_77,

STEP1. To delete the weird user account, especially "zyxelmd", and change all the current user's password.

Many thanks, now I can access.

All suggestion applied.
@Fred_77 Thanks also to you!
Bye

ATP500 Connection refused via web

Accepted Solution

All Replies

Categories

Security Highlight

Security Help Center