Een authenticatie-omissievulnerability in de web-based management interface van Zyxel USG/Zywall series firmware versies 4.35 t/m 4.64 en USG Flex, ATP, en VPN series firmware versies 4.35 t/m 5.01.

The impact of CVE-2021-35029 is severe. Successful exploitation allows an attacker to bypass authentication and gain full control of the affected Zyxel firewall. This could involve modifying firewall rules, stealing sensitive data (user credentials, VPN configurations, network traffic logs), installing malware, or using the device as a pivot point to attack other systems on the network. Given the critical nature of firewalls in network security, a compromised device can have a wide-ranging impact, potentially exposing an entire organization to significant risk. The ability to execute arbitrary commands mirrors the impact of remote code execution (RCE) vulnerabilities, allowing attackers to perform virtually any action they desire on the system.

Organizations relying on Zyxel USG/Zywall series firewalls for network security are at significant risk. This includes small to medium-sized businesses (SMBs), remote offices, and any organization using these devices to protect their network perimeter. Shared hosting environments utilizing Zyxel firewalls are particularly vulnerable, as a compromise of one device could potentially impact multiple tenants.

• linux / server:

journalctl -u zyxel-firewall | grep -i "authentication bypass"

• generic web:

curl -I https://<zywall_ip>/ | grep -i "server: zyxel"

• zyxel: Check Zyxel support portal for specific detection signatures or IDS/IPS rules related to CVE-2021-35029.

1. 2021-07-02Disclosure

   disclosure

2. 2021-07-02Discovery

   discovery

1. Gereserveerd2021-06-17
2. Gepubliceerd2021-07-02
3. Gewijzigd2024-08-04
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2021-35029 is to upgrade to a patched firmware version as soon as it becomes available from Zyxel. Until a patch is applied, consider implementing temporary workarounds to reduce the attack surface. This might involve disabling remote management access via the web interface or restricting access to the management interface to specific IP addresses. Review firewall rules and logs for any suspicious activity. Implement multi-factor authentication (MFA) where possible to add an extra layer of security. Monitor network traffic for unusual patterns that might indicate an ongoing attack.