CVE-2022-0556
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Zyxel AP Configurator (ZAC) version 1.1.4, where incorrect directory permissions allow attackers to execute arbitrary code with local administrator privileges. It affects users running the vulnerable ZAC software locally. Attackers must have local access to exploit this vulnerability.
💻 Affected Systems
- Zyxel AP Configurator (ZAC)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access gains full administrative control over the system, enabling installation of malware, data theft, or persistence mechanisms.
Likely Case
Local users escalate privileges to administrator level, potentially compromising the system and connected network devices.
If Mitigated
With proper access controls and patching, impact is limited to denial of service or minimal data exposure.
🎯 Exploit Status
Exploitation requires local access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1.5 or later
Vendor Advisory: https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml
Restart Required: Yes
Instructions:
1. Download ZAC version 1.1.5 or later from Zyxel's official website. 2. Uninstall the current version. 3. Install the updated version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict Local Access
allLimit physical and remote local access to systems running ZAC to trusted users only.
Remove ZAC if Unused
windowsUninstall ZAC if it is not required for operations.
Control Panel > Programs > Uninstall a program > Select Zyxel AP Configurator > Uninstall
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into systems running ZAC.
- Monitor systems for unusual privilege escalation attempts and review logs regularly.
🔍 How to Verify
Check if Vulnerable:
Check ZAC version via: Open ZAC > Help > About, or check installed programs in Control Panel for version 1.1.4.Check Version:
wmic product where name="Zyxel AP Configurator" get versionVerify Fix Applied:
Verify ZAC version is 1.1.5 or later using the same method, and ensure directory permissions are properly set.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in Windows Event Logs (Security logs)
- Unauthorized access to ZAC directories
Network Indicators:
- Unusual outbound connections from the ZAC host post-exploitation
SIEM Query:
EventID=4672 OR EventID=4688 | where ProcessName contains "zac" OR CommandLine contains "zac"