Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products

Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded, undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices. The flaw, tracked as CVE-2020-29583 CVSS score 7.8,...

A week in security (December 21- December 27)

Last week on Malwarebytes Labs we warned our readers about not so festive social media scams, how Emotet returned just in time for Christmas, we tried out some free online games your kids are playing and here’s what happened, and our VideoBytes episode talked about what penetration testing tools...

CVE-2020-26569

In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. This can result in traffic being discarded on the receiving VLAN. This affects versions: 4.21.12M and below releases...

CVE-2020-29299

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

Command injection

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

CVE-2020-29299

CVE-2020-29299 affects Zyxel SD-OS/On-Premise lines (VPN On-Premise, VPN Orchestrator, USG, USG FLEX, ATP, NSG). A command injection occurs via an admin-provided input string to chg_exp_pwd during a password-change action. Root cause stated in multiple sources: lack of input validation/cleanup in...

CVE-2020-29299

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

PT-2020-17137

Name of the Vulnerable Software and Affected Versions Zyxel VPN On-premise versions prior to ZLD V4.39 week38 Zyxel VPN Orchestrator versions prior to SD-OS V10.03 week32 Zyxel USG versions prior to ZLD V4.39 week38 Zyxel USG FLEX versions prior to ZLD V4.55 week38 Zyxel ATP versions prior to ZLD...

CVE-2020-29299: Improper Neutralization of Special Elements used in a Command

Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...

A ‘Bulletproof’ Criminal VPN Was Taken Down in a Global Sting

Plus: Dozens of reporters get hit by an iMessage exploit, continued fallout from the SolarWinds hack, and more of the week’s top security news...

CVE-2020-27724

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

Code injection

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

CVE-2020-27724

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

CVE-2020-27724

The CVE-2020-27724 entry concerns F5 BIG-IP APM with multiple TMM instances where authenticated VPN users can exhaust resources by sending crafted traffic through the VPN tunnel. Affected releases include BIG-IP APM 16.x (16.0.0–16.0.0.1), 15.x (15.1.0–15.1.0.4, 15.0.0–15.0.1.3), 14.x (14.1.0–14....

Top Security Recommendations for 2021

Happy HaXmas! We hope everyone is having a wonderful holiday season so far. This year has been wild and unpredictable, and has brought unique risks and threats to the forefront of business activities. So, to help everyone stay safer in 2021, the Strategic Advisory Services team here at Rapid7 is...

CVE-2020-27724: Uncontrolled Resource Consumption

In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic ove...

PT-2020-16786

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 11.6.1 through 11.6.5.2 BIG-IP APM versions 12.1.0 through 12.1.5.2 BIG-IP APM versions 13.1.0 through 13.1.3.4 BIG-IP APM versions 14.1.0 through 14.1.3 BIG-IP APM versions 15.0.0 through 15.0.1.3 BIG-IP APM versions 15.1....

Feds seize VPN service used by hackers in cyber attacks

By Deeba Ahmed Cybercriminals’ Favorite VPN Service Rendered ‘Inaccessible’ in a Joint Operation Conducted by Europol and the FBI. This is a post from HackRead.com Read the original post: Feds seize VPN service used by hackers in cyber attacks...

Common Security Misconfigurations and Their Consequences

Everyone makes mistakes. That one sentence was drummed into me in my very first job in tech, and it has held true since then. In the cybersecurity world, misconfigurations can create exploitable issues that can haunt us later - so let's look at a few common security misconfigurations. The first o...

Remote Code Execution Vulnerabilities in Secomea, Moxa, and HMS eWon VPNs

Security researchers at Claroty published details on multiple pre-auth remote code execution vulnerabilities affecting virtual private network VPN implementations primarily used to provide remote access to operational technology OT networks. The vulnerabilities could allow unauthenticated attacke...