CVE-2020-24355
📋 TL;DR
This vulnerability in Zyxel VMG5313-B30B routers allows regular users to create new accounts with administrative privileges by manipulating JSON parameters during account creation. Attackers can exploit insecure permissions to gain full control of affected routers. This affects routers running firmware version 5.13(ABCJ.6)b3_1127 and possibly older versions.
💻 Affected Systems
- Zyxel VMG5313-B30B router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with administrative access, enabling traffic interception, network pivoting, credential theft, and persistent backdoor installation.
Likely Case
Unauthorized administrative access leading to network surveillance, DNS hijacking, and credential harvesting from connected devices.
If Mitigated
Limited impact if proper network segmentation and access controls prevent lateral movement from compromised routers.
🎯 Exploit Status
Exploitation requires existing user credentials; detailed technical analysis available in referenced blog posts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zyxel security advisories for latest patched firmware
Vendor Advisory: https://www.zyxel.com/support/security_advisories.shtml
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Zyxel support portal. 3. Upload firmware via router admin interface. 4. Apply update and restart router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router administration interface
Restrict user account creation
allLimit who can create new user accounts on the router
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN
- Implement strict firewall rules limiting access to router administration ports
🔍 How to Verify
Check if Vulnerable:
Check firmware version via router admin interface; if version is 5.13(ABCJ.6)b3_1127 or older, assume vulnerable.Check Version:
Login to router admin interface and check System Information or Firmware Status pageVerify Fix Applied:
Verify firmware version has been updated to patched version from Zyxel advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual user account creation events
- Multiple failed login attempts followed by successful account creation
- Administrative actions from non-admin user accounts
Network Indicators:
- Unusual outbound connections from router
- DNS configuration changes
- Unexpected administrative traffic to router
SIEM Query:
source="router_logs" AND (event="user_created" OR event="privilege_escalation")🔗 References
- https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
- https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2
- https://www.zyxel.com/support/security_advisories.shtml
- https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
- https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2
- https://www.zyxel.com/support/security_advisories.shtml
