FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-42057

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Sep 3, 2024 / Updated: 2mo ago

010
CVSS 8.1EPSS 0.09%High
CVE info copied to clipboard

Summary

A command injection vulnerability exists in the IPSec VPN feature of several Zyxel device series and firmware versions. This vulnerability affects Zyxel ATP series firmware versions V4.32 through V5.38, USG FLEX series firmware versions V4.50 through V5.38, USG FLEX 50(W) series firmware versions V4.16 through V5.38, and USG20(W)-VPN series firmware versions V4.16 through V5.38. The vulnerability allows an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device.

Impact

If successfully exploited, this vulnerability could allow an attacker to execute operating system commands on the affected device. This could potentially lead to unauthorized access, system manipulation, data theft, or service disruption. The CVSS v3.1 base score of 8.1 (High) indicates severe potential impacts on confidentiality, integrity, and availability of the system. Given that the attack vector is network-based and requires no user interaction, it could be exploited remotely, increasing its potential for widespread impact.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch. The vulnerability affects specific firmware versions, suggesting that an update to a newer, unaffected firmware version might be the solution when it becomes available. However, no explicit patch information is provided in the given data.

Mitigation

While no specific patch is mentioned, several mitigation steps can be recommended: 1. Ensure that the IPSec VPN feature is not configured in User-Based-PSK authentication mode, as the vulnerability is only exploitable in this configuration. 2. Review and remove any user accounts with usernames exceeding 28 characters, as the vulnerability requires a valid user with a long username to be exploited. 3. Implement network segmentation to limit access to the affected devices from untrusted networks. 4. Monitor for any suspicious activities or unauthorized access attempts to the affected devices. 5. Keep an eye out for firmware updates from Zyxel and apply them as soon as they become available. 6. If possible, consider disabling the IPSec VPN feature until a patch is released, if it's not critical for operations.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-42057

Sep 3, 2024 at 2:15 AM
First Article

Feedly found the first article mentioning CVE-2024-42057. See article

Sep 3, 2024 at 2:16 AM / Zyxel
Threat Intelligence Report

CVE-2024-42057 is a critical command injection vulnerability in the IPSec VPN feature of certain Zyxel firewall versions, allowing unauthenticated attackers to execute OS commands. This vulnerability has been acknowledged by security researchers and patches have been released by Zyxel to address it. It is important for organizations using affected firewall versions to apply the patches immediately to prevent exploitation and potential downstream impacts on their network security. See article

Sep 3, 2024 at 2:16 AM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 3, 2024 at 2:21 AM
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.1%)

Sep 3, 2024 at 9:38 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (206735)

Sep 6, 2024 at 9:18 PM
Attribution of Exploits

The vulnerability is known to be exploited by HellDown. See article

Nov 19, 2024 at 5:03 PM / BleepingComputer
Exploitation in the Wild

Attacks in the wild have been reported by Neowin. See article

Nov 19, 2024 at 6:32 PM / Neowin
Static CVE Timeline Graph

Affected Systems

Zyxel/zld_firmware
+null more

Patches

www.zyxel.com
+null more

Links to Malware Families

HellDown
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for multiple vulnerabilities in firewalls
Zyxel / 2mo
CVE-2024-42060 A post-authentication command injection vulnerability in some firewall versions could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. CVE-2024-42059 A post-authentication command injection vulnerability in some firewall versions could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP.
Helldown Ransomware: an overview of this emerging threat
unSafe.sh - 不安全 / 18h
Through our social media monitoring, Sekoia’s Threat Detection & Research (TDR) team identified a tweet posted on 31 October 2024 mentioning a Linux variant of the Helldown ransomware targeting Linux systems. On 4 November 2024, through an analysis of the attack surfaces of various victims, TDR identified that at least eight victims, including one compromised in early August, were using Zyxel firewalls as IPSec VPN access points during the time of their breach.
Helldown Ransomware: an overview of this emerging threat
Research & Threat Intelligence Archives - Sekoia.io Blog / 21h
Through our social media monitoring, Sekoia’s Threat Detection & Research (TDR) team identified a tweet posted on 31 October 2024 mentioning a Linux variant of the Helldown ransomware targeting Linux systems. On 4 November 2024, through an analysis of the attack surfaces of various victims, TDR identified that at least eight victims, including one compromised in early August, were using Zyxel firewalls as IPSec VPN access points during the time of their breach.

News

Helldown Ransomware Group Tied to Zyxel’s Firewall Exploits | #ransomware | #cybercrime
National Cyber Security Consulting / 17min
Attackers wielding an emerging strain of ransomware called Helldown have been gaining a foothold in victims’ networks by exploiting Zyxel firewalls, security researchers warn. The Helldown operation has claimed 31 victims over the past three months, largely by using a Windows version of its crypto-locking malware, together with a data-leak site where it attempts to name and shame victims, French cybersecurity software company Sekoia said Tuesday.
Helldown Ransomware Group Tied to Zyxel’s Firewall Exploits | #ransomware | #cybercrime
National Cyber Security Consulting / 1h
Attackers wielding an emerging strain of ransomware called Helldown have been gaining a foothold in victims’ networks by exploiting Zyxel firewalls, security researchers warn. The Helldown operation has claimed 31 victims over the past three months, largely by using a Windows version of its crypto-locking malware, together with a data-leak site where it attempts to name and shame victims, French cybersecurity software company Sekoia said Tuesday.
Helldown ransomware evolves to target VMware systems via Linux | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware
National Cyber Security Consulting / 1h
While ransomware targeting Linux isn’t unprecedented, Helldown’s focus on VMware systems shows its operators are evolving to disrupt the virtualized infrastructures many businesses rely on, said Patrick Tiquet, vice president, security and architecture at Keeper Security. In a Nov. 19 blog post, Sekoia’s Threat Detection and Research Team reported that while Helldown’s exact methods are unclear, both Cyfirma and Cyberint have found that the group exploits recently disclosed and likely not yet patched vulnerabilities to infiltrate a victim’s network and then deploy ransomware.
CVE-2024-42057: Exploited by Helldown Ransomware to Target Linux
Malware Archives • Cybersecurity News / 2h
The Helldown ransomware group, previously known for targeting Windows systems, has expanded its operations to include Linux machines. This new development was uncovered by Sekoia’s Threat Detection & Research (TDR) team, who identified a tweet mentioning a Linux variant of the Helldown ransomware targeting Linux systems.
Helldown Ransomware Group Tied to Zyxel's Firewall Exploits
BankInfoSecurity.co.uk RSS Syndication / 8h
In September, security firm Cyfirma detailed an August surge in claimed victims by Helldown, which it said was "exploiting vulnerabilities to infiltrate networks and disable security measures, targeting IT services, telecommunications and manufacturing sectors." Following in the double-extortion footprints of numerous other ransomware groups, the attackers regularly stole data and threatened to release it unless victims paid a ransom. Attackers wielding an emerging strain of ransomware called Helldown have been gaining a foothold in victims' networks by exploiting Zyxel firewalls, security researchers warn.
See 65 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 8.1(18246)CWE-78(3977)Zyxel(259)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial