Zyxel statement to vulnerability CVE-2017-3216

A recently uncovered vulnerability identified in US-CERT vulnerability note VU#350135 and CVE Advisory CVE-2017-3216 exposes a security weakness in the web-based administration interface of Zyxel WiMAX Client Premise Equipment (CPE). The vulnerability could allow an unauthenticated attacker to change the administrator password on the device.

Zyxel has conducted a thorough investigation and is now working on the solutions for the susceptible models, as listed in Table 1.

Workarounds

Zyxel suggests users of the susceptible devices disable WAN device management function following the steps below:

1. Log in the web-based management interface of the device
2. Click “Maintenance” and “Remote MGMT”
3. Disable (unclick) “HTTP and HTTPs – allow connection from WAN”
4. Save the setting

Table 1. Susceptible models

Please contact your local service representative if you require further information or assistance. To report a security vulnerability, please contact security@zyxel.com.tw