Zyxel to fix SSH private Key and certificate vulnerability

 

A recently discovered vulnerability identified in advisory CVE-2015-7256 reveals a security issue regarding the authentication of the non-unique certificates and SSH private keys used in networking products. Zyxel has investigated this vulnerability and take several steps to addressing it. Included below are some details.

 

Are Zyxel products affected?

After a thorough investigation in to all Zyxel products, the affected models have been isolated and listed in Table 1 below.

 

What is Zyxel doing about it?

Zyxel is now implementing fixes to ensure the non-unique certificates and SSH private keys used in authentication are randomly generated. Software enhancements will be released shortly, as indicated in Table 1.

 

Any workarounds?

Zyxel suggests users take the following steps as a good general security practice: 

1. Be alert for suspicious web links, advertisements and websites.
2. Make sure all devices are running the most current firmware 

Please contact your local service professional for more information and assistance.

 

Table 1. Affected models