Secret Backdoor Discovered In Zyxel Firewall And AP Controllers

Over 100,000 Zyxel devices are potentially vulnerable to a secret backdoor caused by hardcoded credentials used to update firewall and AP controllers’ firmware.

Niels Teusink of Dutch cybersecurity firm EYE discovered a secret hardcoded administrative account in the latest 4.60 patch 0 firmware for some Zyxel devices.

$ ssh zyfwp@192.168.1.252
Password: Pr ******* Xp
Router> show users current
No: 1
  Name: zyfwp
  Type: admin
(...)
Router>

This account does not show in the Zyxel user interface and has a login name of ‘zyfwp’ and a static plain-text password. Due to the severity of this vulnerability, BleepingComputer decided not to publish the password.

Teusink found that the account could be used to log into vulnerable devices over both SSH and the web interface. Since the SSL VPN interface operates on the same port as the web interface, Teusink found that many users have allowed port 443 to be accessible on the Internet.

“As SSL VPN on these devices operates on the same port as the web interface, a lot of users have exposed port 443 of these devices to the internet. Using publicly available data from Project Sonar, I was able to identify about 3.000 Zyxel USG/ATP/VPN devices in the Netherlands. Globally, more than 100.000 devices have exposed their web interface to the internet,” Teusink reported.

Also Read: Limiting Location Data Exposure: 8 Best Practices

VPN device vulnerabilities are extremely dangerous as they can be used to create new VPN accounts to gain access to an internal network or create port forwarding rules to make internal services publicly accessible.

“Someone could for example change firewall settings to allow or block certain traffic. They could also intercept traffic or create VPN accounts to gain access to the network behind the device. Combined with a vulnerability like Zerologon this could be devastating to small and medium businesses,” Teusink warned.

These types of vulnerabilities have become a favorite among threat actors, who are known to exploit Pulse Secure, Fortinet, and Citrix Netscaler VPN vulnerabilities to deploy ransomware or compromise internal corporate networks to steal data.

Administrators of affected devices should upgrade their devices to the latest firmware as soon as possible.

Zyxel releases new firmware for firewalls

In an advisory, Zyxel thanked EYE’s for their disclosure and stated that they used the hardcoded credentials to deliver automatic firmware updates via FTP.

“A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP,” states Zyxel’s advisory.

Zyxel has released ZLD V4.60 Patch 1 to remove the hardcoded credentials in vulnerable ATP, USG, USG Flex, and VPN devices. Zyxel states that ATP, USG, USG FLEX, and VPN firewalls using earlier firmware or SD-OS are not affected.

The patch for NXC AP controllers is expected to be released in April 2021.

The table of affected Zyxel products and the patch availability is below.

Also Read: 10 Practical Benefits of Managed IT Services

Affected product series	Patch available in
Firewalls
ATP series running firmware ZLD V4.60	ZLD V4.60 Patch1 in Dec. 2020
USG series running firmware ZLD V4.60	ZLD V4.60 Patch1 in Dec. 2020
USG FLEX series running firmware ZLD V4.60	ZLD V4.60 Patch1 in Dec. 2020
VPN series running firmware ZLD V4.60	ZLD V4.60 Patch1 in Dec. 2020
AP controllers
NXC2500	V6.10 Patch1 in April 2021
NXC5500	V6.10 Patch1 in April 2021