^{CVE-2023-34138:}Command injection vulnerability in Zyxel devices allows unauthenticated LAN-based attackers to execute OS commands if their IP is added to trusted RADIUS clients.

Overview

This vulnerability (CVE-2023-34138) affects multiple Zyxel firewall and WLAN controller product lines. The issue exists in the hotspot management feature where improper validation of user input allows for command injection attacks. The vulnerability is particularly concerning as it allows for operating system command execution by unauthenticated attackers. While the attack does require the attacker's IP address to be present in the trusted RADIUS clients list, this could be achieved through social engineering tactics targeting system administrators. Successful exploitation could lead to unauthorized access, data theft, system modification, or using the compromised device as a pivot point for further network attacks.

Remediation

To address this vulnerability, system administrators should:

1. Update affected devices to the latest firmware versions that contain the security patch.
2. For ATP series, USG FLEX series, USG FLEX 50(W) series, USG20(W)-VPN series, and VPN series, update to firmware versions later than 5.36 Patch 2.
3. Implement network segmentation to restrict LAN access to the management interfaces.
4. Follow security best practices when configuring trusted RADIUS clients, and verify the legitimacy of any requests to add new clients.
5. Monitor system logs for suspicious activities that might indicate exploitation attempts.
6. Consider implementing additional network security controls such as intrusion detection/prevention systems to detect and block potential attacks.

References

1. Zyxel Security Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers
2. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
3. MITRE CVE-2023-34138: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34138