Zyxel Firewall Vulnerability Actively Exploited in Attacks

Zyxel has announced awareness of active exploitation attempts by threat actors targeting their firewall products.

This follows a detailed report by cybersecurity firm Sekoia highlighting vulnerabilities previously disclosed in Zyxel’s systems.

The company has responded swiftly to these potential threats, aiming to safeguard its users through vital firmware updates and security enhancements.

CVE-2024-11667: The Vulnerability

The primary vulnerability under exploitation is identified as CVE-2024-11667. This is a directory traversal vulnerability present in the web management interface of Zyxel ZLD firewall firmware versions 5.00 through 5.38.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

It potentially allows malicious actors to download or upload unauthorized files through a specially crafted URL, thereby compromising the security of affected devices.

Zyxel has confirmed that the vulnerabilities, including CVE-2024-11667, have been addressed in their latest firmware release.

Firmware version 5.39, which was made available on September 3, 2024, includes a series of crucial security enhancements designed to block these exploit attempts. Users operating on firmware version 5.39 or later are reportedly safe from this specific threat.

According to the Germany’s Federal Office for Information Security report, the Helldown ransomware, utilizing code from the LockBit ransomware builder, exemplifies the evolving nature of these threats.

Changing all passwords associated with Zyxel firewalls is essential to prevent potential unauthorized access.

Organizations should also monitor for any new or unknown user accounts that might have been created by attackers.

Implementing two-factor authentication, especially for administrative accounts, adds an extra layer of security crucial in the current threat environment.

Furthermore, enabling comprehensive monitoring protocols can help detect unusual activities early and mitigate risks effectively.

Firewalls play a crucial role in protecting organizational networks from cyber threats, making them attractive targets for cybercriminals.

By exploiting these systems, attackers can cause significant data breaches and launch further attacks within a compromised network.

Zyxel urges all users to take immediate action to secure their devices:

1. Update Firmware: Zyxel strongly recommends that all users immediately update their firewall devices to the latest firmware version (5.39 or later). This update is critical for resolving the vulnerabilities and mitigating the risks posed by threat actors.
2. Change Admin Passwords: Updating admin passwords is advised to prevent unauthorized access. Strong, unique passwords should be used to enhance security.
3. Disable Remote Access: If, for any reason, users cannot apply the firmware update immediately, Zyxel advises temporarily disabling remote access to the device. This measure can help reduce exposure to external threats until the device is fully patched.

Zyxel’s proactive measures underscore the importance of timely updates and vigilant cybersecurity practices.

Users are encouraged to follow recommended actions to ensure their network’s safety against this recent wave of attacks.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar