Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender...
Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender SSL VPN Client software
CVE: CVE-2023-5593
Summary
Zyxel has released patches for the Windows-based SecuExtender SSL VPN Client software affected by an out-of-bounds write vulnerability. Users are advised to install them for optimal protection.
What is the vulnerability?
The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software could allow a local authenticated user to gain a privilege escalation by sending a crafted CREATE message.
What versions are vulnerable—and what should you do?
After a thorough investigation, we have confirmed that only the Windows-based SecuExtender SSL VPN Client software is affected and have released a patch to address the issue, as shown in the table below.
Affected model | Affected version | Patch availability |
---|---|---|
SecuExtender SSL VPN Client | V4.0.4.0 (for Windows) |
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgment
Thanks to Daniele Scanu and Fabio Carretto from Soter IT Security for reporting the issue to us.
Revision history
2023-11-21: Initial release.
Comments
-
Hello. Is there a way to audit whether the user has updated the VPN? I looked in the Logs and there is nothing like it available under "SSL VPN". Or is there another way to otherwise block these connections?
Based on this update, it seems that the vulnerability is on the client side. What is to stop a nefarious person from running an old version of SecuExtender and attempting to connect to our network? Currently we limit by region but is there more than that for this case?
0 -
Ok. I did not see that article, just the Zyxel announcement that was emailed out. So they patched the software to protect Windows "admin" access on the client's computer which has nothing to do with compromising the ZyWALL endpoint? It would still be nice to know who is connecting with what. All of our user endpoints are not monitored, some are BYOD, but maybe they should be.
0
Categories
- All Categories
- 415 Beta Program
- 2.3K Nebula
- 141 Nebula Ideas
- 94 Nebula Status and Incidents
- 5.6K Security
- 218 USG FLEX H Series
- 262 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 39 Wireless Ideas
- 6.3K Consumer Product
- 245 Service & License
- 382 News and Release
- 81 Security Advisories
- 27 Education Center
- 8 [Campaign] Zyxel Network Detective
- 3.1K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 83 About Community
- 71 Security Highlight