05. March 2020 - Sebastian Evers
This is good news for users of current hardware, but bad news for owners of older Zyxel hardware. Support for the systems NSA210, NSA220, NSA220 +, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 is no longer offered and there are no more security updates, so that the critical security vulnerability becomes an grave danger - even if no reports have yet been made of attacks that have taken place.
With a Hotfix, the still supported models NAS326, NAS520, NAS540 and NAS542 were temporarily protected. An update for firmware protection (V5.21) will appear in March. Older systems that are denied this update are still vulnerable.
The vulnerability allows attackers to inject malicious code with "remote code execution" with ease, in order to be able to execute additional malicious code with root rights
Some Zyxel firewalls and Zyxel gateways are also critical devices that can be used to execute foreign code via their login mask:
The firmware updates from Zyxel are already available for these devices and should be carried out as soon as possible to prevent possible cyber attacks: Zyxel Hotfix & Firmwareupdate