CVE-2024-42057: Zyxel ZLD IPSec VPN RCE Vulnerability

CVE-2024-42057 Overview

CVE-2024-42057 is a command injection vulnerability [CWE-78] in the IPSec VPN feature of several Zyxel firewall product lines. An unauthenticated remote attacker can execute operating system commands on an affected device by sending a crafted username during IPSec VPN negotiation. The flaw affects Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series firewalls running ZLD firmware versions between V4.16/V4.32/V4.50 and V5.38. Exploitation requires the device to be configured in User-Based-PSK authentication mode with a valid user whose username exceeds 28 characters.

Critical Impact
Successful exploitation grants unauthenticated OS command execution on perimeter firewall devices, providing attackers a foothold for full network compromise.

Affected Products

Zyxel ATP series (atp100, atp100w, atp200, atp500, atp700, atp800) running ZLD V4.32 through V5.38
Zyxel USG FLEX series (usg_flex_100, usg_flex_100ax, usg_flex_100w, usg_flex_200, usg_flex_500, usg_flex_700) running ZLD V4.50 through V5.38
Zyxel USG FLEX 50(W) and USG20(W)-VPN series running ZLD V4.16 through V5.38

Discovery Timeline

2024-09-03 - Zyxel publishes security advisory and CVE-2024-42057 is published to NVD
2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-42057

Vulnerability Analysis

The vulnerability resides in the IPSec VPN authentication path on Zyxel ZLD-based firewalls. When the device is configured in User-Based-PSK authentication mode, the username supplied by the client during the IKE exchange is incorporated into an OS-level command without proper sanitization. An attacker who knows or guesses that a configured user has a username longer than 28 characters can deliver shell metacharacters within that username, causing the firewall to execute attacker-controlled commands. Because IPSec VPN endpoints are typically exposed to the public internet, the attack surface is significant.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The IPSec VPN authentication routine builds a shell command string using the raw username field, and the boundary condition tied to usernames exceeding 28 characters triggers the unsafe code path. No authentication, session, or pre-shared key validation occurs before the vulnerable code executes.

Attack Vector

The attack is performed over the network against the firewall's IPSec VPN listener (UDP/500 and UDP/4500). The attacker sends a crafted IKE authentication request supplying a malicious username payload containing command separators. Exploitation is constrained: the device must use User-Based-PSK authentication, and at least one configured user account must have a username longer than 28 characters. These prerequisites raise attack complexity but do not require credentials, privileges, or user interaction.

No public proof-of-concept exploit is currently available. Refer to the Zyxel Security Advisory for Firewalls for vendor-confirmed technical details.

Detection Methods for CVE-2024-42057

Indicators of Compromise

IKE/IPSec authentication attempts containing unusually long usernames (greater than 28 characters) with shell metacharacters such as ;, |, `, or $()
Unexpected child processes spawned by the IPSec VPN daemon on Zyxel ZLD firewalls
Outbound connections from the firewall management plane to unfamiliar external hosts following IKE traffic spikes

Detection Strategies

Inspect VPN authentication logs for malformed or oversized username fields submitted during IKE Phase 1 negotiation
Correlate IPSec VPN connection attempts with subsequent configuration changes, administrator account creation, or firmware modifications on the firewall
Hunt for anomalous egress from firewall management interfaces, which should rarely initiate outbound traffic

Monitoring Recommendations

Forward Zyxel firewall syslog data to a centralized analytics platform and alert on User-Based-PSK authentication failures with abnormal username payloads
Enable verbose IKE logging on affected devices until patches are applied and review entries containing non-printable or metacharacter content
Monitor for newly created or modified VPN user objects whose usernames exceed 28 characters

How to Mitigate CVE-2024-42057

Immediate Actions Required

Upgrade affected ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN devices to firmware versions released after V5.38 as listed in the Zyxel advisory
Audit configured VPN users and remove or shorten any account whose username exceeds 28 characters until patching is complete
Restrict IPSec VPN exposure to known peer IP ranges where operationally feasible

Patch Information

Zyxel released fixed firmware in the Zyxel Security Advisory for Firewalls published on 2024-09-03. Administrators should apply the vendor-supplied ZLD update appropriate to their hardware model and verify the new firmware version after reboot.

Workarounds

Switch IPSec VPN authentication away from User-Based-PSK mode to certificate-based or IKEv2 EAP authentication where supported
Enforce a username length policy on the firewall that prohibits accounts longer than 28 characters until firmware is updated
Apply geo-IP or source-IP allowlists on the WAN interface to limit who can reach the IPSec VPN service

bash

# Configuration example: verify ZLD firmware version and review VPN user objects
show version
show username
# Remove or rename users whose username length exceeds 28 characters
no username <long-username>