Source: www.securityweek.com – Author: Ionut Arghire
A Zyxel vulnerability that was exploited in a coordinated attack against Denmark’s critical infrastructure two years ago is once again in attackers’ crosshairs, threat intelligence company GreyNoise warns.
The security defect, tracked as CVE-2023-28771 (CVSS score of 9.8), is an improper error message handling issue that can be exploited to execute OS commands remotely.
Attacks targeting the flaw first emerged in May 2023, one month after Zyxel rolled out patches for it, and intensified a month later.
A November 2023 report from non-profit cybersecurity center for critical sectors SektorCERT revealed that 11 Danish energy organizations were compromised in May 2023 through the exploitation of CVE-2023-28771.
The widespread campaign against the country’s critical infrastructure continued throughout May 2023 with the exploitation of other security defects, eventually resulting in the compromise of 22 organizations.
Now, GreyNoise warns of a spike in exploit attempts against CVE-2023-28771, all coming from IP addresses that have not been observed engaging in other scanning or exploitation activities in the two weeks prior.
“Exploitation attempts against CVE-2023-28771 were minimal throughout recent weeks. On June 16, GreyNoise observed a concentrated burst of exploit attempts within a short time window, with 244 unique IPs observed attempting exploitation,” the threat intelligence firm says.
The attacks were mainly aimed at targets in the US, the UK, Spain, Germany, and India. The origin IPs, registered to Verizon Business infrastructure, were from the US, but GreyNoise notes that the true source of the attacks could have been spoofed, as the observed traffic was UDP, on port 500.
Advertisement. Scroll to continue reading.
The threat intelligence firm suspects that the exploitation attempts are associated with a Mirai botnet variant.
Organizations should make sure their Zyxel devices are patched against CVE-2023-28771 and other known vulnerabilities, should apply network filtering to reduce the unnecessary port 500 exposure, and should monitor devices for anomalous behavior.
Related: Mirai Botnets Exploiting Wazuh Security Platform Vulnerability
Related: Russian Hackers Likely Not Involved in Attacks on Denmark’s Critical Infrastructure
Related: US Announces Botnet Takedown, Charges Against Russian Administrators
Related: Europol Targets Customers of Smokeloader Pay-Per-Install Botnet
Original Post URL: https://www.securityweek.com/zyxel-firewall-vulnerability-again-in-attacker-crosshairs/
Category & Tags: Vulnerabilities,exploited,firewall,Zyxel – Vulnerabilities,exploited,firewall,Zyxel
Views: 3
