Zyxel ZLD Firewalls Missing Authorization Vulnerability Allowing Configuration Download

A missing authorization vulnerability has been identified in Zyxel ATP series, USG FLEX series, USG FLEX 50(W) series, and USG20(W)-VPN series, all running specific firmware versions. This vulnerability could allow a semi-authenticated attacker, who has only partially completed the two-factor authentication process, to access and download the system configuration from the affected device.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive system configuration data, which could be misused to compromise the device or network security.

Remediation

Users are advised to update to Zyxel ZLD version 5.41, which addresses this vulnerability.