The affected models include Zyxel's business-grade devices, which are usually deployed across private enterprise and government networks. If exploited, a threat actor would then gain remote access to the VPN, firewall or access point controller. The MS-ISAC update notes that the username and password of this administrative account cannot be changed. 'As SSL VPN on these devices operates on the same port as the web interface, a lot of users have exposed port 443 of these devices to the internet,' the Eye Control researchers say. The researchers also found that a threat actor who identified that administrative account could then log into the device using the web interface or the Secure Shell - SSH - protocol.

It uses 'zyfwp' as the username and a static plain-text password that anyone can see. The Eye Control researchers found that this vulnerability creates an administrative account that does not appear in the products' user interface.

'The account was designed to deliver automatic firmware updates to connected access points through FTP,' according to the Zyxel security alert.

The vulnerability involves hardcoded credentials being used to update the firmware in the company's products. The flaw was not present within previous versions of the firmware. The vulnerability was discovered by the Eye Control researchers after Zyxel pushed out firmware update 4.60 patch 0, according to the report. 'This could allow the attacker to change firewall settings, intercept traffic and create VPN accounts to gain access to the network behind the device and other administrative functions,' according to the MS-ISAC alert. While no exploits have been spotted in the wild, the MS-ISAC report notes that a threat actor could use the vulnerability to gain administrative access to the inner parts of a targeted network and further escalate privileges. On Monday, the Multi-State Information Sharing and Analysis Center, or MS-ISAC, issued an alert that the vulnerability poses a risk for large enterprises and government agencies that use the company's security and networking products. In an advisory, however, the company notes that a fix for its NXC access point controller series products would not be released until April. Zyxel, which has already posted patches for the vulnerability in some of its products, is urging its customers to immediately apply them. See Also: Live Webinar | Making the Case for Managed Endpoint Detection and Response A firmware vulnerability in about 100,000 Zyxel products, including VPN gateways, access point controllers and firewalls, can be used to install a hardcoded backdoor that could give threat actors remote administrative privileges, according to the Dutch security firm Eye Control.

Summit zyxel firmware