Backdoor in Zyxel Products
> A hardcoded credential vulnerability was identified in the “zyfwp” user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP.<p>Also translated as:<p>In the name of "improving security" we created a backdoor, which is known throughout the entire industry as "removing all security". We are very sorry we were caught so easily.<p>It does not take much to understand this was a terrible idea. Or that there are so many better ways to build and deploy automatic updates. You absolutely do not need to be able to control a machine remotely to deploy automatic updates. But counting the ways they went wrong building this update system makes it extremely hard to believe that was the intent.<p>> After a thorough investigation, we’ve identified the vulnerable products that are within their warranty and support period and are releasing firmware patches to address the issue, as shown in the table below.<p>That they went to the effort of identifying their minimal viable liability and all released patches for that, makes it even more disingenuous.<p>This is a company whose business is supposed to be about enhancing security. They should know better.