CVE-2022-0823

Observable Discrepancy (CWE-203)

Published: Jun 9, 2022 / Updated: 29mo ago

Once deployed on a targeted host, the attack chain downloads and executes the Metasploit’s Mettle meterpreter to maximize control, exploits vulnerabilities to elevate its privileges, adds persistence on the host via crontab, and ultimately launches a cryptocurrency miner on infected devices. Successful exploitation of the above vulnerabilities could cause a remote denial-of-service (DoS), or enable an attacker with physical access to the device to extract sensitive information or alternatively carry out adversary-in-the-middle attacks.

“A format string vulnerability was found in a specific binary of Zyxel NAS products that could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet,” the company said in an advisory released on September 6. Networking equipment maker Zyxel has released patches for a critical security flaw impacting its network-attached storage (NAS) devices.

Once deployed on a targeted host, the attack chain downloads and executes the Metasploit’s Mettle meterpreter to maximize control, exploits vulnerabilities to elevate its privileges, adds persistence on the host via crontab, and ultimately launches a cryptocurrency miner on infected devices. Successful exploitation of the above vulnerabilities could cause a remote denial-of-service (DoS), or enable an attacker with physical access to the device to extract sensitive information or alternatively carry out adversary-in-the-middle attacks.

Networking equipment maker Zyxel has released patches for a critical security flaw impacting its network-attached storage (NAS) devices. The post Critical RCE Vulnerability Affects Zyxel NAS Devices — Firmware Patch Released appeared first on .

Networking equipment maker Zyxel has released patches for a critical security flaw impacting its network-attached storage (NAS) devices. "A format string vulnerability was found in a specific binary of Zyxel NAS products that could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet," the company said in an advisory released on September 6.

Networking equipment maker Zyxel has released patches for a critical security flaw impacting its network-attached storage (NAS) devices. The post Zyxel NAS Devices Have a Critical RCE Vulnerability; A Firmware Patch Has Been Released appeared first on The Cybersecurity Daily News .