CISA Warns of Zyxel Firewalls, CyberPanel, North Grid, & ProjectSend Flaws Exploited in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about several vulnerabilities being actively exploited in the wild.

The vulnerabilities affect popular software and hardware products, including Zyxel firewalls, CyberPanel, North Grid, and ProjectSend.

Organizations using these products are urged to apply mitigations immediately or discontinue usage if fixes are unavailable.

CVE-2024-51378: CyberPanel Incorrect Default Permissions Vulnerability

CyberPanel has been identified as having an incorrect default permissions vulnerability, referenced as CVE-2024-51378.

This flaw facilitates an authentication bypass, allowing attackers to execute arbitrary commands through shell metacharacters in the statusfile property.

The vulnerability is related to CWE-276, which pertains to incorrect default permissions. This issue has been linked to known ransomware campaigns, highlighting the urgency for organizations to address it.

Free Webinar on Best Practices for API vulnerability & Penetration Testing:  Free Registration

CVE-2023-45727: North Grid Proself Improper Restriction of XML External Entity

Another significant vulnerability, CVE-2023-45727, affects North Grid Proself products, including the Enterprise/Standard, Gateway, and Mail Sanitize versions.

This improper restriction of XML External Entity (XXE) reference vulnerability could enable a remote, unauthenticated attacker to conduct XXE attacks. The issue is associated with CWE-611, which involves improperly handling XML input.

CVE-2024-11680: ProjectSend Improper Authentication Vulnerability

The open-source file sharing software ProjectSend is also under scrutiny with CVE-2024-11680.

This improper authentication vulnerability permits remote attackers to modify the application’s configuration through crafted HTTP requests to options.php.

Exploiting this flaw can lead to account creation, webshell uploads, and embedding malicious JavaScript. Related to CWE-287, it is a critical issue that could have severe implications if left unaddressed.

CVE-2024-11667: Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2024-11667 affects multiple Zyxel firewall models, presenting a path traversal vulnerability within the web management interface.

This vulnerability allows attackers to download or upload files using crafted URLs, aligning with CWE-22, which involves path traversal concerns. Notably, this vulnerability is known to be leveraged in ransomware campaigns, increasing its threat profile.

CISA’s advisory underscores the critical nature of these vulnerabilities and the need for immediate action to prevent potential exploitation.

Organizations using Zyxel firewalls, CyberPanel, North Grid, or ProjectSend are advised to prioritize system updates and mitigation efforts.

Failure to address these vulnerabilities could lead to severe security breaches, including data loss and unauthorized access, reinforcing the importance of proactive cybersecurity measures.

Analyse Real-World Malware & Phishing Attacks With ANY.RUN - Get up to 3 Free Licenses