{"id":8313,"date":"2020-03-08T11:18:55","date_gmt":"2020-03-08T10:18:55","guid":{"rendered":"http:\/\/blog.actn.fr\/?p=8313"},"modified":"2020-03-08T11:18:55","modified_gmt":"2020-03-08T10:18:55","slug":"zyxel-probleme-de-securite-vulnerabilite-dexecution-de-code-a-distance-dans-le-nas-et-firewall","status":"publish","type":"post","link":"https:\/\/blog.actn.fr\/?p=8313","title":{"rendered":"ZYXEL : Probl\u00e8me de s\u00e9curit\u00e9 (vuln\u00e9rabilit\u00e9 d&#039;ex\u00e9cution de code \u00e0 distance) dans le NAS et Firewall"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[\n\n<div class=\"article-body print-only\">\n\n<span style=\"text-decoration: underline;\">Article du support technique de ZYXEL<\/span>\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\"><span class=\"wysiwyg-color-black\"><strong>Les produits Zyxel NAS (Network Attached Storage) et Firewall sont<\/strong><\/span> <span class=\"wysiwyg-color-red\"><strong>affect\u00e9s par une vuln\u00e9rabilit\u00e9 d&rsquo;ex\u00e9cution de code \u00e0 distance.<\/strong><\/span> <strong>Il est conseill\u00e9 aux utilisateurs d&rsquo;installer imm\u00e9diatement notre dernier firmware pour une protection optimale.<\/strong><\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><strong> <img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8314\" src=\"http:\/\/blog.actn.fr\/wp-content\/uploads\/2020\/03\/200316-zyxel.jpg\" alt=\"\" width=\"600\" height=\"300\" \/><\/strong><\/p>\n\n\n\n\n<p class=\"bold\" style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\"><span class=\"wysiwyg-color-red80\"><strong>Quelle est la vuln\u00e9rabilit\u00e9?\n<\/strong><\/span>Une vuln\u00e9rabilit\u00e9 d&rsquo;ex\u00e9cution de code \u00e0 distance a \u00e9t\u00e9 identifi\u00e9e dans le weblogin.cgi utilis\u00e9 dans les produits NAS et pare-feu Zyxel. <\/span><\/p>\n\n\n\n\n<p class=\"bold\" style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\">L&rsquo;authentification manquante pour le programme pourrait permettre aux attaquants d&rsquo;ex\u00e9cuter du code \u00e0 distance via l&rsquo;injection de commandes du syst\u00e8me d&rsquo;exploitation.\n<\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-color-black wysiwyg-font-size-large\"><strong>\u00a0<\/strong><\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\"><strong><span class=\"wysiwyg-color-red80\">Quels produits sont vuln\u00e9rables et que devez-vous faire?<\/span><\/strong>\nApr\u00e8s une \u00e9tude approfondie des gammes de produits compl\u00e8tes, nous avons confirm\u00e9 que la vuln\u00e9rabilit\u00e9 affecte les produits suivants ex\u00e9cutant des versions de firmware sp\u00e9cifiques:<\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\">&#8211; Produits NAS ex\u00e9cutant la version 5.21 du micrologiciel et les versions ant\u00e9rieures.\n&#8211; Les pare-feu UTM, ATP et VPN ex\u00e9cutant la version de firmware v4.35 Patch 0 \u00e0 v4.35 Patch 2. <\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\">Ceux avec des versions de firmware avant v4.35 Patch 0 ne sont PAS affect\u00e9s.\n<\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\">Nous avons identifi\u00e9 les produits vuln\u00e9rables couverts par leur garantie et leur p\u00e9riode d&rsquo;assistance, comme indiqu\u00e9 dans le tableau ci-dessous. <\/span><\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-large\">Pour une protection optimale, nous invitons les utilisateurs \u00e0 installer les correctifs et les correctifs de micrologiciel standard uniquement lorsqu&rsquo;ils sont disponibles.<\/span><\/p>\n\n\n\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\">\n\n<span class=\"wysiwyg-underline wysiwyg-font-size-large\">Produits concern\u00e9s<\/span>\n\n\n<ul>\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>NAS326 NAS520 NAS540 NAS542<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>ATP100 ATP200 ATP500 ATP800<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>USG20-VPN USG20W-VPN USG40 USG40W<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>USG60 USG60W USG110 USG210<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>USG310 USG1100 USG1900 USG2200<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>VPN50 VPN100 VPN300 VPN1000<\/strong><\/span><\/li>\n\n\n \t\n\n<li><span class=\"wysiwyg-color-blue\"><strong>ZyWALL110 ZyWALL310 ZyWALL1100<\/strong><\/span><\/li>\n\n\n<\/ul>\n\n\n<span class=\"wysiwyg-color-blue\"><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/strong><\/span>\n\n<\/div>\n\n\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\"><span class=\"wysiwyg-color-green120 wysiwyg-font-size-x-large\">Notre firmware et l&rsquo;article complet se trouvent ici:<\/span><\/div>\n\n\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-x-large\"><a href=\"https:\/\/www.zyxel.com\/support\/remote-code-execution-vulnerability-of-NAS-products.shtml\">https:\/\/www.zyxel.com\/support\/remote-code-execution-vulnerability-of-NAS-products.shtml<\/a><\/span><\/div>\n\n\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\"><\/div>\n\n\n\n\n<div class=\"table-responsive\">\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\"><span class=\"wysiwyg-color-green120 wysiwyg-font-size-x-large\">Explore FAQ &#8211; Upgrading latest NAS remote code execution vulnerability firmware<\/span><span class=\"wysiwyg-color-green120 wysiwyg-font-size-x-large\">:<\/span><\/div>\n\n\n\n\n<div class=\"table-responsive\" style=\"text-align: justify;\"><span class=\"wysiwyg-font-size-x-large\"><a href=\"https:\/\/homeforum.zyxel.com\/discussion\/3370\/faq-upgrading-latest-nas-remote-code-execution-vulnerability-firmware#latest\">https:\/\/homeforum.zyxel.com\/discussion\/3370\/faq-upgrading-latest-nas-remote-code-execution-vulnerability-firmware#latest<\/a><\/span><\/div>\n\n\n<\/div>\n\n\n<\/div>\n\n]]>\t\t<\/p>\n<!-- AddThis Advanced Settings generic via filter on the_content --><!-- AddThis Share Buttons generic via filter on the_content -->","protected":false},"excerpt":{"rendered":"<a href=\"https:\/\/blog.actn.fr\/?p=8313\"><\/a><p>\t\t\t\t<![CDATA[]]>\t\t<!-- AddThis Advanced Settings generic via filter on get_the_excerpt --><!-- AddThis Share Buttons generic via filter on get_the_excerpt --><\/p>\n","protected":false},"author":2,"featured_media":8314,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_price":"","_stock":"","_tribe_ticket_header":"","_tribe_default_ticket_provider":"","_tribe_ticket_capacity":"0","_ticket_start_date":"","_ticket_end_date":"","_tribe_ticket_show_description":"","_tribe_ticket_show_not_going":false,"_tribe_ticket_use_global_stock":"","_tribe_ticket_global_stock_level":"","_global_stock_mode":"","_global_stock_cap":"","_tribe_rsvp_for_event":"","_tribe_ticket_going_count":"","_tribe_ticket_not_going_count":"","_tribe_tickets_list":"[]","_tribe_ticket_has_attendee_info_fields":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[40,49],"tags":[536,1278,1288,1343,1422],"class_list":["post-8313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutoriels","category-zyxel-marques","tag-firewall","tag-usg","tag-utm","tag-vpn","tag-zyxel"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts\/8313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8313"}],"version-history":[{"count":0,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts\/8313\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/"}],"wp:attachment":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}