Omnia  Ally Member

I think there is an day 0. Maybe something related to the web page. Close all access from wan it's only way to be secured ( maybe).

Hi, we have the same. the problem was that the password are compromised from 5.37/5.38 vulnerability. We have changed all password after the update to 5.39. we have close access to administration page to our ip, Geo-ip defence sslvpn and 2fa for all the user.…

@Deuba check when they have create the user from secureporter, in other case we see they have created the user/admin and have delete it after use

Hi @Deuba, we have a similar incident, but they have gained access from a SSLVPN user with the right password. Maybe they have created the user in the pass, when you don't have the 2fa? there is other admin without 2fa? maybe you can check event in secureporter to check when they create the user.

@Deuba if you haven't change password after the update, the password could be retrive in the past using 5.38 CVE or later

@deuba Did you have admin web-page open or with geoip? did you have change password in the last 2 months?

we have the same issue and persist after reboot

We have the same!

Hi, Thank you for your response. I understand that the current Cross-Org site clone feature does not include device names in the new organization. However, given that it is a cloning process, I assumed that all associated attributes, including device names, would be replicated to maintain consistency and ease of…

Have you make a bwm on your tunnel?

It's a very late release.

Here you can find many guide check if it can help you!

https://support.zyxel.eu/hc/en-us/categories/360001546960-Next-Generation-Firewall https://support.zyxel.eu/hc/en-us/articles/4411322123666-Best-Practice-ATP-UTM-Features

"started playing around with VPN. Goal was when traveling to have access to ISP (not local resources)" - IPsec can access to the resource of phase2 policy.. in same cases can go to the internet by your firewall but it isn't a standard configuration "I might need additional pointers here. My goal was to block traffic from…