Text field enabled in two-factor authentication (2FA)

Options
QuiteSmart
QuiteSmart Posts: 78
Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - WLAN
image  Ally Member
edited October 12 in Security Ideas

When you enter the url to enter the google authenticator OTP for the 2FA of the firewalls you cannot just digit the 6 numbers but you have to click in the field (or press tab) to activate the text field.

Moreover, after inserting the OTP you cannot hit enter to go ahead but you have to click on the green button.

You should enable that field by default and allow to send the OTP with ENTER so everybody will save 2 clicks (not to mention all the users who start typing without knowledge that they are writing nothing), this is something technically possibile since, for example, when you browse the main google page it has the search text field enabled.

Thank you

6
Up Down
6 votes

Active · Last Updated

Comments

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,843
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    edited October 13
    Options

    Hi @QuiteSmart ,

    Since you mentioned the green button, we’re assuming you’re using the USG FLEX H firewall with this screen.

    image.png

    We tested with firmware 1.39 on MS Edge and Google Chrome: on the “Enter Two-factor Authentication Verification code and click to verify” screen, we were able to type the OTP immediately, without needing to click into the field (or press Tab) to activate it. We could also press Enter to log in, without needing to click the “Verify” green button.

    If you test with the same environment and still see the original symptom, please share your browser name and a screen recording of the login process so we can check further.

    Zyxel_Judy

  • QuiteSmart
    QuiteSmart Posts: 78
    Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - WLAN
    image  Ally Member
    Options

    Hello, thank you for your fast reply.

    We have to types of 2FAs:

    1. the one for the admin entering the firewall, this works without any problem (and it is the one of your screenshot if i see it well)
    2. the one for the users entering a VPN. After the user/password connection via openSSL or IPSec if 2FA is enabled you have to browse to http(s)://anyinternalfirewallip:2FAport for example http://192.168.1.1:8000
    image.png

    this happens to me using Chrome Version 155.0.8059.40 (Build ufficiale) (a 64 bit)

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,843
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Options

    Hi @QuiteSmart ,
    Thank you for the detailed information. We were able to reproduce the symptom with VPN 2FA, and we’ll evaluate it further.

    Zyxel_Judy

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,843
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Options

    Hi @QuiteSmart ,

    After reviewing this, we have determined it is a bug and have already fixed it in the 1.40 weekly firmware version (26WK45). You can wait for the official 1.41 firmware release, or let us know your model name and we can send you the 1.40 26WK45 version.

    Zyxel_Judy

  • QuiteSmart
    QuiteSmart Posts: 78
    Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - WLAN
    image  Ally Member
    Options

    Thank you very much for your feedback. I'm glad i've hunted a bug!
    When will 1.41 be released?

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,843
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Options

    Hi @QuiteSmart,

    The USG FLEX H series uOS 1.41 is scheduled for release on January 18, 2027.

    Zyxel_Judy

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）