Zyxel security advisory for authentication bypass vulnerability of firewalls

CVE: CVE-2022-0342

Summary

Zyxel has released patches for products affected by the authentication bypass vulnerability. Users are advised to install them for optimal protection.

What is vulnerability?

An authentication bypass vulnerability caused by the lack of a proper access control mechanism has been found in the CGI program of some firewall versions. The flaw could allow an attacker to bypass the authentication and obtain administrative access to the device.

What versions are vulnerable—and what should you do?

After a thorough investigation, we’ve identified the vulnerable products that are within their warranty and support period and released updates to address the issue, as shown in the table below.

 *Please reach out to your local Zyxel support team for the file.

Got a question?

Please contact your local service rep or visit Zyxel’s forum for further information or assistance.

Acknowledgments

Thanks to the following researchers for reporting the issue to us:

• Alessandro Sgreccia from Tecnical Service Srl
• Roberto Garcia H and Victor Garcia R from Innotec Security