ExploitCVE-2023-33012
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
A command injection vulnerability exists in the configuration parser of various Zyxel firewall and WLAN controller products. This vulnerability affects multiple series including ATP, USG FLEX, USG20(W)-VPN, and VPN series with firmware versions ranging from 5.00 to 5.36 Patch 2. The vulnerability allows an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.
Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary OS commands on the affected devices. This could potentially lead to unauthorized access, data manipulation, or complete system compromise. Given that the attack can be performed by an unauthenticated user from the LAN, it poses a significant risk to internal network security. The vulnerability is classified as "HIGH" severity, indicating a serious threat that should be prioritized for patching.
Exploitation
One proof-of-concept exploit is available on github.com. Its exploitation has been reported by various sources, including vulncheck.com.
Patch
A patch is available. Zyxel has released security updates to address this vulnerability. The patch details can be found on the Zyxel website at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers.
Mitigation
1. Update affected devices to the latest firmware version provided by Zyxel. 2. If immediate patching is not possible, consider disabling cloud management mode as the vulnerability is only exploitable when this mode is enabled. 3. Implement strict access controls on the LAN to limit potential attackers' ability to reach vulnerable devices. 4. Monitor system logs for any suspicious activities or unauthorized command executions. 5. Consider implementing network segmentation to isolate vulnerable devices if they cannot be immediately patched.
Timeline
Feedly found the first article mentioning CVE-2023-33012. See article
Attacks in the wild have been reported by VulnCheck Blog. See article
The vulnerability CVE-2023-33012 affects a wide range of Zyxel firewalls and has been actively exploited in the wild, with approximately 33% of internet-facing firewalls being vulnerable. There are no proof-of-concept exploits available, but Zyxel has released patches to address the issue. Downstream impacts to other third-party vendors or technologies have not been reported. See article