Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender...

Zyxel_May · November 2023

Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender SSL VPN Client software

CVE: CVE-2023-5593

Summary

Zyxel has released patches for the Windows-based SecuExtender SSL VPN Client software affected by an out-of-bounds write vulnerability. Users are advised to install them for optimal protection.

What is the vulnerability?

The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software could allow a local authenticated user to gain a privilege escalation by sending a crafted CREATE message.

What versions are vulnerable—and what should you do?

After a thorough investigation, we have confirmed that only the Windows-based SecuExtender SSL VPN Client software is affected and have released a patch to address the issue, as shown in the table below.

Affected model	Affected version	Patch availability
SecuExtender SSL VPN Client	V4.0.4.0 (for Windows)	V4.0.5.0 (for Windows)

Got a question?

Please contact your local service rep or visit Zyxel’s Community for further information or assistance.

Acknowledgment

Thanks to Daniele Scanu and Fabio Carretto from Soter IT Security for reporting the issue to us.

Revision history

2023-11-21: Initial release.

NEP · November 2023

Hello. Is there a way to audit whether the user has updated the VPN? I looked in the Logs and there is nothing like it available under "SSL VPN". Or is there another way to otherwise block these connections?

Based on this update, it seems that the vulnerability is on the client side. What is to stop a nefarious person from running an old version of SecuExtender and attempting to connect to our network? Currently we limit by region but is there more than that for this case?

rainpwn · November 2023

https://community.zyxel.com/en/discussion/comment/58927#Comment_58927

In their LinkedIn post, they talk about a local-privelege-escalation. So it's about Windows, not ZYWALL Endpoint.

NEP · November 2023

Ok. I did not see that article, just the Zyxel announcement that was emailed out. So they patched the software to protect Windows "admin" access on the client's computer which has nothing to do with compromising the ZyWALL endpoint? It would still be nice to know who is connecting with what. All of our user endpoints are not monitored, some are BYOD, but maybe they should be.

dairytheme · February 15

The only thing I saw was the Zyxel announcement in the email; I didn't see the story itself. So, they installed a security patch to prevent the burrito craft client's Windows "admin" account from gaining unauthorized access, even though this has zero bearing on the ZyWALL endpoint? Knowing who is interacting with what would still be helpful. Even while some of our users bring their own devices to work, not all of them are under monitoring.