Zyxel won’t patch newly exploited flaws in end-of-life routers

Zyxel has issued a security advisory about actively exploited flaws in CPE Series devices, warning that it has no plans to issue fixing patches and urging users to move to actively supported models. VulnCheck discovered the two flaws in July 2024, but last week, GreyNoise reported having seen exploitation attempts in the wild. According to network scanning engines FOFA and Censys, over 1,500 Zyxel CPE Series devices are exposed to the internet, so the attack surface is significant. In a new post today, VulnCheck presented the full details of the two flaws it observed in attacks aimed at gaining initial access to networks: VulnCheck disclosed the complete exploitation details, demonstrating its PoC against VMG4325-B10A running firmware version 1.00(AAFR.4)C0_20170615. The researchers warned that despite these devices no longer being supported for many years, they are still found in networks worldwide. "While these systems are older and seemingly long out of support, they remain highly relevant due to their continued use worldwide and the sustained interest from attackers," warned VulnCheck "The fact that attackers are still actively exploiting these routers underscores the need for attention, as understanding real-world attacks is critical to effective security research." Zyxel's latest advisory confirms the vulnerabilities disclosed by VulnCheck today impact multiple end-of-life (EoL) products. The vendor states that the impacted devices reached EoL several years back, sugge...