Cybersecurity Threat Advisory: ZyXEL NAS RCE Vulnerability (CVE-2020-9054)

Several ZyXEL NAS devices are vulnerable to Remote Code Execution (RCE). The vulnerability could potentially allow an attacker to execute remote commands as root. A patch has been released, but many devices are at an end of life stage and do not have an update. SKOUT recommends updating firmware immediately on all supported devices and hardening (or replacing) end of life devices.

A Remote Code Execution (RCE) vulnerability exists in the “weblogin.cgi” executable that is used in a wide variety of ZyXEL NAS and firewall products. Specifically, the program fails to properly sanitize the “username” parameter that it is passed. If this parameter contains specific characters, a command injection may be allowed with the privileges that are given to the web server that runs on the vulnerable ZyXEL device.

This vulnerability exists in a number of ZyXEL devices (a full list of which is included in the “References” below). This exploit is simple but highly reliable; and while the web server that is exploited does not run as the root user, numerous ZyXEL devices include a “setuid” utility which can run any command with root privileges. Due to the simplicity of the exploit, a malicious actor can readily locate thousands of vulnerable devices with pre-provided links and easily attempt the exploit. Additionally, even without direct connectivity to the vulnerable device a malicious actor can compromise a ZyXEL device. A user simply viewing a website that has been compromised can result in this exploit being performed on any ZyXEL device reachable from the client system.

When exploited, this vulnerability allows a malicious actor to execute any number of remote commands or arbitrary code, potentially at root privilege with the “setuid” command. Also of note is recent activity suggesting that ransomware groups have been actively working to fold this exploit into notorious malware “Emotet”, meaning this exploit could be leveraged to propagate ransomware attacks.

What are the recommendations?

ZyXEL has patched the vulnerability in several of the affected devices and recommends downloading these firmware updates available as soon as possible. However, some of the devices affected by the vulnerability have been identified by ZyXEL as end of life and are no longer supported and thus will not have this update available. In either case you can also harden your devices against exploitation with the following security steps:

• Block access to the web interface (80/tcp and 443/tcp) on any vulnerable ZyXEL device.
• Restrict access to vulnerable ZyXEL devices by not exposing them to the internet directly.

Download the hotfix here: https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml

References: