Loading vulnerability…
OS command injection in Zyxel firewall IPSec VPN
CVE-2024-42057 is a command injection vulnerability in the IPSec VPN feature of Zyxel ATP firmware V4.32–V5.38, USG FLEX firmware V4.50–V5.38, USG FLEX 50(W) firmware V4.16–V5.38, and USG20(W)-VPN firmware V4.16–V5.38. An unauthenticated remote attacker can execute some operating-system commands by submitting a crafted username. Successful exploitation requires User-Based-PSK authentication mode and an existing valid user whose username exceeds 28 characters.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated operating-system command execution on the affected firewall and can provide an initial foothold for further intrusion. Exploitation for initial compromise in ransomware attacks has been reported. Attribution of specific Helldown intrusions to this CVE remains unconfirmed; the execution privilege level and full scope of accessible commands are not established.
If you can’t patch tonight, do this now.
Temporarily disable remote access to vulnerable firewalls until patched firmware can be installed.
Patch, then assume compromise.
Upgrade affected ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN devices to firmware version 5.39, which addresses the vulnerability. Change all administrator and user account passwords as an additional response measure, particularly where credentials may have been stolen during earlier compromises.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.