Zyxel Patched Numerous Security Flaws Across Different Products

Zyxel recently addressed several security vulnerabilities in its firewalls and router devices with a series of security fixes. One of the most critical vulnerabilities identified could lead to OS command injection on Zyxel routers.

Critical OS Command Injection Vulnerability in Zyxel Routers

Zyxel disclosed an OS command injection vulnerability impacting various router models. Known as CVE-2024-7261, this vulnerability affects access points and security router versions, as mentioned in the company’s advisory.

The CVE listing elaborates on the vulnerability and affected devices:

The vulnerability in the CGI program of Zyxel routers could potentially allow an attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

This critical vulnerability received a CVSS score of 9.1, and Zyxel has released security patches for affected devices. Users are advised to update their devices promptly to mitigate the risk.

High-Severity Buffer Overflow Issue Resolved

Another significant vulnerability, CVE-2024-5412, addressed a high-severity buffer overflow issue affecting various Zyxel products. This vulnerability could be exploited by an unauthenticated attacker to trigger a denial of service on the target device.

Zyxel provided a list of affected products and corresponding patched releases in their advisory.

Multiple Security Flaws Fixed in Zyxel Firewalls

In addition to the aforementioned vulnerabilities, Zyxel also patched seven security flaws in multiple firewall versions. These include:

• CVE-2024-6343 (medium; CVSS 4.9): Buffer overflow vulnerability in the CGI program
• CVE-2024-7203 (high; CVSS 7.2): Post-authentication OS command injection
• CVE-2024-42057 (high; CVSS 8.1): OS command injection in the IPSec VPN feature
• CVE-2024-42058 (high; CVSS 7.5): Null pointer dereference vulnerability
• CVE-2024-42059 (high; CVSS 7.2): Post-authentication OS command injection via FTP
• CVE-2024-42060 (high; CVSS 7.2): OS command injection via internal user agreement file
• CVE-2024-42061 (medium; CVSS 6.1): Reflected cross-site scripting (XSS)

These vulnerabilities affected various Zyxel firewall models, and patches have been released for all affected devices. Users are urged to update their devices to stay protected.

Share your thoughts in the comments section below.