At the end of the last week, the Rapid7 cybersecurity company dismissed a mechanic who failed in the pare-fire of the manufacturer of Zyxel modem taiwans. Celle-ci peut permettre à un attakuant remote removed no authentication of executing the code in tant qu’utilisateur. The problem of programming resides in the absence of verification of entries, two champs transmission to a CGI management is introduced in the appeals system. The models affect the VPN and ATP series, as well as the USG 100 (W), 200, 500, 700 and Flex 50 (W) / USG20 (W) -VPN models.
At this time, Rapid7 may announce 15,000 models online. Toutefois, in the course of the week-end, the Shadowserver Foundation will port more than 20,800. «More popular: USG20-VPN (10K IP) and USG20W-VPN (5.7K IP). Additional models of affects CVE-2022-30525 are in the UE – France (4.5K) and Italy (4.4K) “, posted on Twitter l’ONG, which specializes in detecting threats to work.
To indicate if you have been able to exploit the failed failures since May 13, you will be able to use Zyxel’s modem users to apply the correct missions online. After Rapid7 signaled the vulnerability on April 13, the manufacturer of Taiwan’s computerized material published in the correct discretion on April 28. Rapid7 did not realize that on May 9 the publication will be published, and the final publication will be a blog and a module Metasploit at the same time as Zyxel’s report, and will not be satisfied with the chronicles.
Anticipation of disclosure
“This publication will correct the publication of details of vulnerabilities, the attackers will be able to invert the correct points to know the details of the exploitation, to find the right defenders, to find the defenders of defense”. search for Rapid7 in the default of the failed file.
“This is why we have published this anticipation of anticipation of the help of defenders to detect the exploitation and help of those who want to apply what is correct in their learning near the environment, in the form of a beautiful lesson. In other cases, the correctness of the vulnerability is strong and tends to help the attacker act, and the defenders in the ignorance of the risk of realizing the problems of undiscovered problems. »
From his point of view, Zyxel affirmed that he was a “teacher in the course of the process of coordination of disulgation” and that he “suited his principles of coordinated disulgence”. If you want, Zyxel has published a CVSS 9.8 vulnerability in the CGI program that allows you to control authentication and enjoy access to administration.
Source: ZDNet.com