Zyxel, a networking equipment manufacturer, has released urgent security updates to address critical vulnerabilities in their network-attached storage devices. CVE-2023-27992 (CVSS score: 9.8) has been declared as a pre-authentication command injection vulnerability.
What is the threat?
The threat involves multiple vulnerabilities affecting Zyxel network-attached storage devices. These vulnerabilities are primarily classified as remote code execution (RCE). Attackers can take advantage and exploit these vulnerabilities.
Why is it noteworthy?
This threat is noteworthy due to the potential impact it can have on organizations relying on Zyxel networking equipment. If exploited, these vulnerabilities can lead to unauthorized access, compromising network integrity, stealing sensitive information, or disrupting network operations. Zyxel devices are used globally, and these vulnerabilities can pose significant risks to organizations across various industries.
What is the exposure or risk?
Organizations that use vulnerable Zyxel devices are exposed to potential attacks that can result in unauthorized access to critical systems, data breaches, or disruption of network services.
What are the recommendations?
Barracuda SOC recommends the following actions to mitigate the risk associated with these vulnerabilities:
- Apply security updates: Update Zyxel products to the latest versions provided by Zyxel to address the identified vulnerabilities.
- Network segmentation: Limit potential impact of the compromise by segmenting the network.
- Strong access controls: Enforce strong and unique passwords for all devices and implement two-factor authentication where possible to add an additional layer of security.
- Security awareness training: Educate employees about the risks of CVE-2023-27992 vulnerability. Promote a culture of cybersecurity awareness, emphasizing the importance pre-authentication command injection. Proactive security measures and prompt patching are vital to maintaining a robust cybersecurity posture.
References
For more in-depth information about the recommendations, please visit the following links:
- https://thehackernews.com/2023/06/zyxel-releases-urgent-security-updates.html
- https://vulners.com/thn/THN:E01BA864178661422A9F19F66807FED5
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
- https://socradar.io/zyxel-firewall-flaws-exploited-urgent-action-required/
If you have any questions regarding this Cybersecurity Threat Advisory, please contact our Security Operations Center.
