{"id":38972,"date":"2021-01-02T03:59:00","date_gmt":"2021-01-02T03:59:00","guid":{"rendered":"http:\/\/362744cf-a1b2-4b1b-87dd-3d64c61de6d8"},"modified":"2021-01-02T03:59:00","modified_gmt":"2021-01-02T03:59:00","slug":"backdoor-account-discovered-in-more-than-100000-zyxel-firewalls-vpn-gateways","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/backdoor-account-discovered-in-more-than-100000-zyxel-firewalls-vpn-gateways\/","title":{"rendered":"Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways"},"content":{"rendered":"
\"zyxelatp.jpg\"<\/span>
<\/span> Image: Zyxel <\/span><\/figcaption><\/figure>\n

More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel.<\/p>\n

The backdoor account, discovered by a team of Dutch security researchers from Eye Control, is considered as bad as it gets in terms of vulnerabilities.<\/p>\n

Device owners are advised to update systems as soon as time permits.<\/p>\n

Security experts warn that anyone ranging from DDoS botnet operators to state-sponsored hacking groups and ransomware gangs could abuse this backdoor account to access vulnerable devices and pivot to internal networks for additional attacks.<\/p>\n

Affected modules include many enterprise-grade devices<\/h2>\n

Affected models include many of Zyxel’s top products from its line of business-grade devices, usually deployed across private enterprise and government networks.<\/p>\n

This includes Zyxel product lines such as:<\/p>\n