VPN Firewall is a security device that protects corporate assets from being directly exposed to the public internet. However, what if such a security device itself has vulnerabilities? Once these high-value vulnerabilities are discovered, malicious organizations could exploit them to launch attacks, leaving the enterprise directly exposed to risks. Our research focuses on the potential attack surface of Zyxel VPN Firewall when exposed to the public internet. During the research process, we discovered several vulnerabilities, and promptly notified the relevant authorities to release patches.

In this session, we will uncover recent critical vulnerabilities in the IPSec VPN of Zyxel VPN Firewall. We will delve into the causes of these vulnerabilities, their corresponding impacts, and how to identify vulnerable Zyxel devices within the entire network. The severity of these vulnerabilities has drawn international researchers' attention, and due to their quick reproducibility and stability in attack programs, they have been maliciously exploited by botnets. The United States Cybersecurity and Infrastructure Security Agency (CISA) has even issued related warnings in response.

Through this session, we aim to collectively explore the risks associated with these vulnerabilities and emphasize the importance of product security for VPN Firewalls.