Zyxel security advisory for buffer overflow vulnerability

CVE: CVE-2020-25014

Summary

Zyxel has released updates for a buffer overflow vulnerability affecting firewalls and access points. Users are advised to install the updates for optimal protection.

What is the vulnerability?

A buffer overflow vulnerability was identified in the “fbwifi_continue” CGI program due to a lack of input validation on some Zyxel security firewalls and access points that support the Facebook WiFi feature.

What products are vulnerable—and what should you do?

After a thorough investigation of our product lines, we’ve identified the vulnerable products that are within their warranty and support period and released patches to address the issue, as shown in the table below. For optimal protection, we urge users to install the applicable updates.

Note that non-listed products are NOT affected because they do not support the Facebook WiFi feature.

 

Affected product series

Patch available in

Firewalls

VPN series running firmware

ZLD V4.30 through ZLD V4.55

-       On-premise: ZLD V4.39 week38* and above

-       Orchestrator: SD-OS V10.03 patch 1 and above

USG series running firmware

ZLD V4.30 through ZLD V4.55

ZLD V4.39 week38* and above

USG FLEX series running firmware ZLD V4.30 through ZLD V4.55

ZLD V4.55 week38* and above

Access points

Unified Pro series

V6.10 patch 8 and above

Unified series

V6.10 patch 8 and above

Standalone series

V6.10 patch 8 and above

* Please reach out to your local Zyxel support team for the file.

Contact your local Zyxel support team if you require further assistance.

 

 

Articles in this section

Was this article helpful?
0 out of 0 found this helpful
Share