Zyxel Issues Patches for 4 New Flaws Affecting AP, API Controller and Firewall Devices

Zyxel has released patches^[1]
to address four security flaws affecting its firewall, AP
Controller, and AP products to execute arbitrary operating system
commands and steal select information.

The list of security vulnerabilities is as follows –

• CVE-2022-0734 – A cross-site scripting (XSS)
  vulnerability in some firewall versions that could be exploited to
  access information stored in the user’s browser, such as cookies or
  session tokens, via a malicious script.

• CVE-2022-26531 – Several input validation
  flaws in command line interface (CLI) commands for some versions of
  firewall, AP controller, and AP devices that could be exploited to
  cause a system crash.

• CVE-2022-26532 – A command injection
  vulnerability in the “packet-trace^[2]” CLI command for some
  versions of firewall, AP controller, and AP devices that could lead
  to execution of arbitrary OS commands.

• CVE-2022-0910 – An authentication bypass
  vulnerability affecting select firewall versions that could permit
  an attacker to downgrade from two-factor authentication to
  one-factor authentication via an IPsec VPN client.

While Zyxel has published software patches for firewalls and AP
devices, hotfix for AP controllers affected by CVE-2022-26531 and
CVE-2022-26532 can be obtained only by contacting the respective
local Zyxel support teams.

The development comes as a critical command injection flaw in
select versions of Zyxel firewalls (CVE-2022-30525^[3], CVSS score: 9.8) has
come under active exploitation, prompting the U.S. Cybersecurity
and Infrastructure Security Agency to add the bug to its Known
Exploited Vulnerabilities Catalog.