Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender...

Options
Zyxel_May
Zyxel_May Posts: 134  Zyxel Employee
First Anniversary First Comment

Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender SSL VPN Client software

CVE: CVE-2023-5593

Summary

Zyxel has released patches for the Windows-based SecuExtender SSL VPN Client software affected by an out-of-bounds write vulnerability. Users are advised to install them for optimal protection.

What is the vulnerability?

The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software could allow a local authenticated user to gain a privilege escalation by sending a crafted CREATE message.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have confirmed that only the Windows-based SecuExtender SSL VPN Client software is affected and have released a patch to address the issue, as shown in the table below.

Affected model

Affected version

Patch availability

SecuExtender SSL VPN Client

V4.0.4.0 (for Windows)

V4.0.5.0 (for Windows)

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Daniele Scanu and Fabio Carretto from Soter IT Security for reporting the issue to us.

Revision history

2023-11-21: Initial release.

Comments

  • NEP
    NEP Posts: 64  Ally Member
    First Anniversary 10 Comments Friend Collector
    edited November 2023
    Options

    Hello. Is there a way to audit whether the user has updated the VPN? I looked in the Logs and there is nothing like it available under "SSL VPN". Or is there another way to otherwise block these connections?

    Based on this update, it seems that the vulnerability is on the client side. What is to stop a nefarious person from running an old version of SecuExtender and attempting to connect to our network? Currently we limit by region but is there more than that for this case?

  • rainpwn
    rainpwn Posts: 13
    First Anniversary Friend Collector First Comment
    edited November 2023
    Options

    In their LinkedIn post, they talk about a local-privelege-escalation. So it's about Windows, not ZYWALL Endpoint.

  • NEP
    NEP Posts: 64  Ally Member
    First Anniversary 10 Comments Friend Collector
    Options

    Ok. I did not see that article, just the Zyxel announcement that was emailed out. So they patched the software to protect Windows "admin" access on the client's computer which has nothing to do with compromising the ZyWALL endpoint? It would still be nice to know who is connecting with what. All of our user endpoints are not monitored, some are BYOD, but maybe they should be.

  • dairytheme
    Options

    The only thing I saw was the Zyxel announcement in the email; I didn't see the story itself. So, they installed a security patch to prevent the burrito craft client's Windows "admin" account from gaining unauthorized access, even though this has zero bearing on the ZyWALL endpoint? Knowing who is interacting with what would still be helpful. Even while some of our users bring their own devices to work, not all of them are under monitoring.

  • easeshould
    easeshould Posts: 1
    First Comment
    edited June 20
    Options

    I didn't read the actual report; all I saw in the email was the Zyxel announcement. So, despite the fact that this has no effect on the ZyWALL endpoint, they deployed a security patch to stop the burrito craft client's Windows "admin" account from being accessed without authorization? It would still be useful to know who is engaging with what. Not all of our users are observed, even when some of them bring their own gadgets to work, planet clicker.