INCIBE reports vulnerabilities in ISC BIND, Aruba, and ZyXEL products

INCIBE has issued updates regarding several high-severity cybersecurity vulnerabilities affecting various networking and storage products.

In the ISC BIND software, a vulnerability (CVE-2015-5477) allows remote attackers to cause a denial of service through TKEY queries in specific versions. Additionally, multiple high-severity vulnerabilities have been identified in Aruba Networks and ArubaOS products. These include flaws that allow authenticated attackers to overwrite arbitrary files via the web interface or execute arbitrary commands with privileged user rights through the command-line interface.

ZyXEL has also been flagged for a critical vulnerability (CVE-2020-9054) affecting multiple Network-Attached Storage (NAS) devices running firmware version 5.21. This pre-authentication command injection flaw allows an unauthenticated remote attacker to execute arbitrary code. By sending specially crafted HTTP requests, an attacker could potentially gain root privileges on the vulnerable device.