zyxel command injection cve-2023-28771

I've asked this same question. It is a daily attack, so they are pretty persistent. I've been blocking the IPs but they keep coming back with different IPs. I'm grateful that Norton has blocked it, but the daily nature of this is frustrating. Their persistence might win out sooner or later.

What I found out online is that this apparently relates to a Zyxel driver being compromised and Zyxel has an updated patch to resolve it. It effects their firewall software, advanced threat protection software, vpn software, and I have no idea what the USG Flex product is. Zyxel security advisory for OS command injection vulnerability of firewalls — Zyxel Community

Nothing I have is Zyxel, I use Norton for Firewall, and for VPN, and as far as I know all my threat protection is through that. So that leaves whatever Flex is, or maybe the unused software for security that came with the computer is still there but dormant. Until I can figure out what driver needs updated I'm stuck.

I did a search of all my drivers, but it does not list by publisher and Zyxel is not in the driver name apparently. I selectively tried different devices and so far nothing uses a driver published by Zyxel. Ought to be a better way to find out.

Starting to suspect it is the internal driver for one of my routers, but I have no idea how to see what the drivers are for those external devices. I suppose I ought to find out how to update my firmware for all my routers and such.

Maybe this info gives you an idea what to look into next. If I find out anything I'll share it with you, and would appreciate if you do likewise.

I'm having the same issue. No Zyxel products on my computer. Daily intrusion notifications; intrusion blocked; no action required.

Question: Could the source of the problem be previous networking with a computer that uses a Zyxel firewall or router?

Your ISP may have given you the old snowball answer about the modem they provide you with. Can you tell us what the manufacturer of your modem is and what model it is? That information should be on the router itself and visible. I would like to look up a few things to possible determine if your modem is the actual attack vector.

The IP address 109.207.200.44 in your screenshot traces to Ukraine as shown in the URL below. More likely than not there is a nation state sponsor behind whatever is going on:

https://www.ip-tracker.org/lookup.php?ip=109.207.200.44

As far as determining what software has been installed and removed on your devices, that is basically fishing for a needle in a haystack. Conversely, software most times leave rogue files that can be removed if done properly, it should state what the software was and used for when it is detected for removal. I often suggest using CCleaner to declutter a hard drive of files that are just taking up space and can cause issues down the road over time when left. You can get a "free trial" at the link below. Please let us know what you find so we can help further.

https://www.ccleaner.com/

SA

I have been dealing with the exact same thing starting on June 11th.

These "Zyxel Command Injection Attacks" coming from IP 109.207.200.47 and 109.207.200.44 were happening a few times at first and then increased to over 40 times a day.

Norton told me I don't need to take any action and also said it is pointless to even add a new Traffic Rule to block this specific IP in my firewall settings. 

I am wondering if they are correct, because if one specific IP address is hammering you over and over, surely there is a way to stop these attacks permanently?  

1. Would it help to report this to US Cyber Security or to contact my ISP?

2. I am tempted to hit "STOP NOTIFYING ME" so I don't see these notifications every ten minutes, but then I'm concerned that I might miss an important notification about this issue.  Would you select "STOP NOTIFYING ME"?

Same here, always from 109.207.200.44.

I sent a mail to the ISP tied to the attacking IP in Ukraine recently so hopefully they take action and the attacks will stop eventually. I'm so sick and tired of this. 20+ attacks yesterday, 20+ and counting today.

Same here. Once from 193.32.162.190, other attacks from 109.207.200.44. I've contacted my ISP, they dont use Zyxel devices. Now i'm testing connected mobile phone (as USB modem), after 3+ hours zero attacks. I'll continue testing.

All:

You need to realize that these attempted attacks are not targeting you personally. They are bots that hammer as many IP addresses as they can looking for a system that in this case will have a Zyxel device on their network. If you to not have any of these device on your personal system, you have nothing to worry about. If you do, as you have seen, your Norton has blocked the attempt. So again you have nothing to worry about. 

Given time, these attacks should stop as the attackers realize that there is nothing at your IP address.

This is nothing Norton can do to stop the attackers from trying to access your system. 

1. Would it help to report this to US Cyber Security or to contact my ISP?

This might be the best course of action.

skeeterj ebersole:

Peterweb,

So in other words 'they' (via their bot) are sending this Zyxel exploit broadly to a huge batches of IPs not knowing which, if any, use a Zyxel product. Norton is blocking it, but only computers using one of the affected Zyxel products are even at risk from this particular exploit anyhow? Is that right.

Correct.

So basically this just serves as a reminder to do what we all ought to periodically do anyhow, which is make sure all our devices have the latest updates, and to check our settings on everything for the best practices in regard to optimizing protection.

This is also correct. All users should always endeavour to ensure all software and drivers are up to date to protect against new malware.

Thanks everyone for your input and advice on what to check and change.

Dear 

My Laptop computer was also attacked by  the same  intrusion attempt came from 109.207.200.44 or 109.207.200.47 from 14 June 2023 and the problem still exists today. I have not used any Zyxel products. 

I am trying your suggestion but in the Intrusion Autoblock page, I cannot enter the attacking IP as the row was frozen. 

I wonder many Norton users are encountering same problem this week. 

That is not the right place for adding a permanent block.

Open your security tab, at the top of the window click on a settings gear icon. There choose firewall, at the top tabs on firewall you want to go to traffic rules. Search for an item in the rules that says block known attacker and add the IP address to a list there, or create a new item for block known attacker if you don't have an existing one, or wish to track it separately.

(Edit, that is what I found I had to do, but it took some time to figure that out. It was not easy to find or get to the first time around)

I was not suggesting it for blocking the port, which I haven't done, I was suggesting it for blocking specific IP addresses. So far I've been adding the attacking IPs to it, but there are no end of new ones they can use to keep it up, so it is a bandaid and not a long term solution.

As far as stopping the Norton notifications, you can select "STOP NOTIFYING ME" when these "threat blocked" messages appear.

I was questioning the wisdom of doing so just in case a more important message relating to these attacks ever happens, but I'm not sure.

I'm just wondering, how did these hackers get our IP addresses?  I haven't been using a VPN, but really I don't know how my IP address would be public?  I play a lot of chess on the internet on public sites, could they maybe have gotten it that way?

I sent a copy of numerous intrusion events to "abuse@maximuma.net.ua" which is listed as the abuse contact for Domain 109.207.200.xx.  If "Maximuma.net.ua" isn't a complete scam, I may get a reply back or the internet provider may stop the accounts associated with 109.207.200.44 and 109.207.200.47.  We'll see . . .

I used to manage security issues on a small UNIX system.  About 75% of the time, I was able to get internet providers and subnets to stop users who were making attacks.  But that was predicated on the "abuse" contacts being honest and nobody "spoofing" ip addresses.  So far, I've had no response from "abuse@maximuma.net.us."  My next option is to stop all inbound traffic from Domain 109.... I've experienced these types of attacks escalate to the point where they became so numerous and frequent that internet access slowed significantly or stopped.

I have a few more questions about these attacks, but first off I just want to thank everyone for your help and information thus far, for an issue that seems to have little practical information available outside of this topic.

First, given that this is seemingly from a botnet searching for possible holes rather than personally targeted, especially since no here seems to have any actual Zyxel products, would it be safe to assume that there is nothing on the user end broadcasting/calling for these attacks. Since neither Norton or Malwarebytes have detected any threats on my computers themselves, I assume I can think of my machines themselves as not being threatened, correct?

Second, since these attacks have happened to a computer connected to a separate wireless router, as well as one directly plugged in to my modem, should I be concerned in any way that my router or modem may be compromised and thus the cause of these attacks or pose a risk to any other devices on my network?

Finally, I have been looking to replace my wireless router with newer one for better coverage, prior to these attacks. Would it be safe or advised to setup a new router during these attacks or should I just wait and hope that they eventually stop first?

Again, thanks for the assistance so far.

I checked stop notifying me, and log only, but it ignores my request. I tried that a bunch of times.. stop doesn't work... that is what I already said in my post... stop doesn't work, it hasn't done it today... but for several days it ignored my stop request

@WolfmanL 

Second, since these attacks have happened to a computer connected to a separate wireless router, as well as one directly plugged in to my modem, should I be concerned in any way that my router or modem may be compromised and thus the cause of these attacks or pose a risk to any other devices on my network?

In an earlier post I gave recommendations for users concerning their modems and routers. Check for firmware updates for your current devices and ensure the company who makes them are still supporting firmware updates. If they are not, I would replace with a more modern router that is supported. Conversely, if you are using an ISP provided device ask your ISP to assist with the latest firmware and whether they have patched said firmware against these types of attack vectors. Log into your devices and check settings and logs for excessive traffic and whether the attacks are being dinged within the firewalls that are built into these devices. 

I need to again stress the issue that, your ISP SHOULD be filtering for these attack avenues so they are mitigated BEFORE you ever see them make it into your network. I would ask why they are not. Most of the vulnerable devices that MiraBot is scanning for is being used by ISP's and other large corporations. If they don't patch, don't see the internal obfuscation happening or just plain ignore it we the consumer will see it. Corporations are driven by "policy" vice common sense. Data breeches are a dime a dozen in todays world, and its a fact that, companies tell their IT people to remain moot about breeches as well as other issues that may cost them regarding their bottom line. 

SA

Since i perma blocked two IP addresses i  haven't had an intrusion attempt since the 15th. However if the problem returns perhaps i should just ask my IPS for a new ip address?

You mention the abuse is from an internet service in Texas, that is relevant to me since I'm using a Texas ISP.  Perhaps others in this thread are also, maybe you're onto something.

You said they scanned for vulnerable computers, why would I be vulnerable?  I don't think I'm even using a Zyxel firewall, the original attack said:

"The attack was resulted from a \DEVICE\HARDDISKVOLUME4\WINDOWS\SYSTEM32\SVCHOST.EXE"

Does this mean I do have a Zyxel vulnerability?

By the way, I seriously think we should consider reporting these attacks to:  

https://www.ic3.gov/Home/ComplaintChoice/default.aspx

Trough Norton Click on Open Device Security/settings/Firewall/Intrusion Browser Protection. On Intrusion Autoblock click configure. If the 2 IPs are currently blocked by autoblock they will be listed. Choose Restricting instead of the 30 min default and click apply.

I looked there earlier but I don't have any IP listed in the box at the bottom even tho I'm getting these attacks as I'm typing this. All I have is AutoBlock On (Recommended) or Off. I have no option to manually add an IP and then perma block? No IP is ever added to that box, all I get is the pop-up warning telling me that the attempt was blocked but they can keep spamming these attemps non-stop and I've had over 40 attemps today alone...

All: Since these are attacks that are using random IP addresses, AND, you are all living in different geo-locations, my suggestion is disable the UPnP setting in your ISP device and/or router settings. This will prevent the automatic opening of ports on BOTH those devices when scans occur. It will be an inconvenience since you would have to manually setup new devices and services, but at this point, the risk of having it enabled is greater than not having it enabled. The attacks should stop at that level. Some time ago I had an issue with my NAS where UPnP enabled for it was a backdoor into my network connecting to the NAS locally. It was firmware related. The OEM refused to patch, even to this date, so I have it offline and use is when its only necessary via USB direct. Here are some other suggestions as well. 

If you turn off UPnP altogether, your router will ignore all incoming requests so you'll have to set up devices manually. This means that the router will no longer automatically open ports on your LAN, ignoring even legitimate requests

https://www.tomsguide.com/us/home-router-security,news-19245.html

SA

I set up my ISP device and second router like 6 years ago, made the username and password something I'd remember. Six years after never touching it again, I can't remember what they were. If I knew one for sure I could stand a chance at guessing the other.

The ISP people don't understand why I didn't just leave it with the factory name/password, and can't tell me what settings I'll need to know when I factory reset their machine. They also won't send a tech out to help while everything is working fine.

So when I can afford to be without the internet for a day, I'm going to factory reset it and when it won't connect to their end, get a tech out to play with the settings.