The main brands of commercial NAS servers are QNAP, Synology and ASUSTOR, three leading brands that are oriented both to the domestic world with quite powerful and affordable NAS, as well as to the business world with the most advanced models. The manufacturer Zyxel also has various models of NAS servers, and now a security researcher has discovered serious vulnerabilities that could lead to code execution on the computer, allowing them to be hacked easily. Next, we explain all the details.
What security flaw have you discovered?
The security flaw that has been found is of the “format string” type, this flaw is in a binary file of the NAS servers of the manufacturer Zyxel, and could allow an attacker to remotely execute unauthorized code, so he could hack the device via a properly crafted UDP packet. This security flaw would allow full access to the NAS without the need to know the user credentials, for this reason it has a severity of 9.8/10. This security flaw has a CVE code assigned to it, specifically the code CVE-2022-34747.
This serious security flaw affects the following NAS server models:
- NAS326
- NAS540
- NAS542
Regarding the firmware versions, depending on the model it affects some versions or others, specifically, the affected versions are:
- On the NAS326 the bug was found in version 5.21(AAZF.11)C0 or earlier.
- On the NAS540 the bug was found in version 5.21(AATB.8)C0 or earlier.
- On the NAS542 the bug was found in version 5.21(ABAG.8)C0 or earlier.
This vulnerability has been reported when the manufacturer had just fixed two other serious vulnerabilities in its firewall products, a critical network component that must be without any type of security flaw to properly protect the internal network. In the case of firewalls, this local privilege escalation vulnerability, and another authenticated direct traversal vulnerability have already been fixed in July.
What should I do to protect the NAS?
In recent years, cybercriminals are targeting home and business NAS servers to infect them with ransomware and encrypt each and every file and folder inside them. Due to recent events, the security measures that can be taken to avoid becoming infected are:
- Do not expose the management port of the NAS to the Internet.
- Open only the necessary ports for remote access, such as VPN only or FTP server.
- Whenever you want to access remotely, the best advice is to use a VPN server so that we have strong authentication and there are no problems.
As preventive measures against ransomware disasters, the best thing you can do is 3-2-1 backups , in order to be able to recover all your files in case
