Fix The Critical Flaws Found In Zyxel Products

Security researchers disclosed four new critical flaws in Zyxel Products including AP, API Controller, and Firewall Devices. These flaws let attackers to carryout cross-site scripting, command injection, and an authentication bypass vulnerabilities on the affected Zyxel products. This post is going to be important for those who use Zyxel’s AP, API Controller, and Firewall products on their network. In this post we are going to see about the four flaws found in Zyxel products, Product’s with version information affected by these vulnerabilities, and most importantly, how to fix these critical flaws found in Zyxel products.

Summary Of The Critical Flaws Found In Zyxel Products:

Here is the list of four flaws found in Zyxel products.

CVE-2022-0734

A cross-site scripting vulnerability was identified in the CGI program of some firewall versions that could allow an attacker to obtain some information stored in the user’s browser, such as cookies or session tokens, via a malicious script.

CVE-2022-26531

Multiple improper input validation flaws were identified in some CLI commands of some firewall, AP controller, and AP versions that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.

CVE-2022-26532

A command injection vulnerability in the “packet-trace” CLI command of some firewall, AP controller, and AP versions could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the command.

CVE-2022-0910

An authentication bypass vulnerability caused by the lack of a proper access control mechanism has been found in the CGI program of some firewall versions. The flaw could allow an attacker to downgrade from two-factor authentication to one-factor authentication via an IPsec VPN client.

Zyxel Products And Its Versions Affected By These Flaws:

As per the security advisory published by Zyxel, multiple products and versions are affected by these vulnerabilities.

How To Fix the Critical Flaws Found in Zyxel Products?

Zyxel has released software updates for firewalls and AP devices, However, the vendor has released hotfixes for AP controllers affected by CVE-2022-26531 and CVE-2022-26532. Note: The hotfixes can only be obtained by contacting the Zyxel support. Please contact the support for AP Controller updates.

Please reefer this table below to see the patched versions.

We hope this post would help you know how to fix these critical flaws found in Zyxel products. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr,  Medium & Instagram, and subscribe to receive updates like this.