Secunia

DiSToAGe has reported that ZyXEL ZyNOS is affected by a known information disclosure vulnerability, which can be exploited by malicious people to obtain potentially sensitive information.

The vulnerability is caused due to frames being padded with content from previous packets or memory instead of using NULL-bytes. This can be exploited by sending specially crafted packets to a vulnerable device.

The vulnerability has been reported in a Zyxel Prestige 650R-11 ADSL router running ZyNOS V3.40(ES.5). Other Prestige routers and versions of ZyNOS may also be affected. However, the vendor originally reported to CERT that the vulnerability didn't affect ZyXEL devices running ZyNOS 2.50 through 3.60.

NOTE: According to the original advisory, the vulnerability was only tested on the local interface. It is therefore not currently known whether the external interface also is affected.

Solution
Update to the latest version of ZyNOS, which may fix the issue.

Provided and/or discovered by
DiSToAGe

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area