InfoSecBulletin Cybersecurity for mankind
CERT Germany and Zyxel have alerted about a serious vulnerability in Zyxel firewalls, identified as CVE-2024-11667. This flaw is being exploited to spread Helldown ransomware, with reports of at least five affected organizations in Germany.
CVE-2024-11667 is a directory traversal vulnerability in Zyxel’s ZLD firmware versions 5.00 to 5.38. Exploiting it allows attackers to upload and download files using crafted URLs, which can compromise sensitive information like system credentials. This may lead to further attacks, such as creating rogue VPN connections and changing firewall settings.
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
The affected devices include:
Zyxel ATP and USG FLEX series firewalls in on-premise mode, using ZLD firmware versions 4.32 to 5.38 with remote management or SSL VPN enabled. Devices using Nebula cloud management are not affected.
Initial Release date: 21, November 2024
Updated date: 27, November-2024
Current Date: November 29, 202
Zyxel Europe was reportedly one of the victims.
At least 32 victims worldwide have been reported on Helldown’s data leak site
According to CERT-Bund, five German groups are potential targets
To keep your network safe, Zyxel suggests taking these steps:
Update Firmware: Update your device to the latest firmware..
Disable Remote Access: If updates can’t be applied right away, temporarily turn off remote access to your device until the firmware is patched.
Review Best Practices: Review general cybersecurity guidelines.
