Who uses firewalls from zyxel, should bring this to the current status. Otherwise, attackers were able to log directly via the internet via ssh on devices and access them with admin rights.
This scenario now jerks in tangible close as attackers currently actively scan to ssh connections. On a zyxel ssh connection, you could log in due to the young discovered backdoor account zwyfp with a well-known password.
Among other things, the sans internet storm center reports on the scans in a message. For the firewalls of the atp, usg, usg flex and vpn series, the secured firmware 4 is.60 patch1 appeared. According to zyxel, but only firewalls are danger that between 25. November and 3. December 2020 on the firmware 4.60 have been updated.
The security update 6.10 patch1 for the vulnerable access point controllers nxc2500 and nxc5500 should according to a warning message of zyxel on the 8. January. Vpn devices with sd-os should not be affected.
General safety tips
Generally, admin accounts are always accessible only for a committed group of people. In addition, you should avoid access via the internet to reduce the attack surface. If it does not let it be avoided, you should sufficiently secure and seal such remote accesses.
In addition, admins have to make sure that the firmware is always up to date. Where it works, you should automate such checks and installations.
On the back tower, a security researcher of the dutch it security committee eye. Zyxel specifies to have created the account management not visible in the account management for automatic firmware updates via ftp. The password is static and not changeable. It is the access via ssh and the web interface possible.