CVE-2020-13365 : What You Need to Know

Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used for a TELNET session as root. This vulnerability affects various Zyxel NAS models.

Understanding CVE-2020-13365

This CVE identifies a security vulnerability in Zyxel NAS devices that could potentially lead to unauthorized access.

What is CVE-2020-13365?

CVE-2020-13365 is a vulnerability in Zyxel NAS devices that enables a non-root user to create a password for an undocumented user account, granting unauthorized access as root via TELNET.

The Impact of CVE-2020-13365

The vulnerability has a CVSS base score of 8.4, indicating a high severity level. The impact includes high confidentiality, integrity, and availability risks, with no privileges required for exploitation.

Technical Details of CVE-2020-13365

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability allows a non-root user to generate a password for an undocumented user account, providing unauthorized root access via TELNET on affected Zyxel NAS models.

Affected Systems and Versions

The following Zyxel NAS models and versions are affected:

NAS520: V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, V5.11(AASZ.0)C0
NAS542: V5.11(ABAG.0)C0, V5.20(ABAG.1)C0, V5.21(ABAG.3)C0
NSA325: v2_V4.81(AALS.0)C0, V4.81(AAAJ.1)C0
and more

Exploitation Mechanism

The vulnerability can be exploited by a non-root user to create a password for an undocumented user account, allowing unauthorized access as root via TELNET.

Mitigation and Prevention

Protecting systems from CVE-2020-13365 is crucial to prevent unauthorized access and potential security breaches.

Immediate Steps to Take

Disable TELNET services on affected Zyxel NAS devices if not required
Implement strong password policies for all user accounts
Regularly monitor and audit system access logs for any suspicious activities

Long-Term Security Practices

Keep NAS firmware up to date with the latest security patches
Conduct regular security assessments and penetration testing on NAS devices
Educate users on best security practices and the risks associated with unauthorized access

Patching and Updates

Zyxel may release patches or firmware updates to address the vulnerability. Ensure timely installation of these updates to mitigate the risk of exploitation.