Zyxel first introduced ZyNOS in 1998.
Web and/or command line interface (CLI) depending on the device. Web access is accomplished by connecting an Ethernet cable between a PC and an open port on the device and entering the IP address of the device into the Web browser. An RS-232 serial console port is provided on some devices for CLI access, which is accomplished by using SSH or telnet.
CLI command types
Listed below are the categories that the CLI commands are grouped by.
- basic settings
- advanced application
- IP application
As of January 2014 a ZyNOS ROM-0 vulnerability has been identified. This vulnerability allowed attacker to download router's configuration (ROM-0 file) without any type of authentication required. Such configuration file can be later decompressed to expose router's administrator password, ISP password, wireless password etc.
As of March 2014[update], Secunia reports seven advisories and six vulnerabilities on ZyNOS version 3.x. Five advisories are unpatched; Secunia rates the most severe unpatched advisory as less critical.
As of January 2015[update], a DNS vulnerability has been found in certain ZyNOS firmware versions. The versions that are affected have not been narrowed down. The attack can be done from a remote location regardless if the user interface is accessible from the outside of a LAN.
- Tseng, Mickey. "ZyNOS General FAQ". Zyxeltech.de. Retrieved 2014-03-07.
- "Timeline". Archived from the original on 2012-05-31. Retrieved 2012-06-06.
- "ZYXEL LAUNCHES IPv6 UPGRADE FOR BUSINESS SECURITY GATEWAYS AND ETHERNET SWITCHES". Archived from the original on 2012-05-12. Retrieved 2012-06-06.
- "ZyBook2.book" (PDF). Retrieved 2014-03-07.
- "Ethernet Switch Reference Guide V3.90 (Nov 2008)" (PDF). Retrieved 2014-03-07.
- Tseng, Mickey. "ZyNOS CI Command List". Zyxeltech.de. Retrieved 2014-03-07.
- Nasro (2014-01-11). "How I saved your a** from the ZynOS (rom-0) attack !! ( Full disclosure )". root@Nasro. Retrieved 2019-08-18.
- "ZyNOS ROM-0 DECODER".
- Soo, Jacob (2015-05-12), GitHub - jacobsoo/ROM0_Decoder: Rom0 Decoder., retrieved 2019-08-18
- "ZyXEL ZyNOS 4.x". Secunia. Retrieved 2014-03-07.
- "ZyXEL ZyNOS 3.x". Secunia. Retrieved 2014-03-07.
- "DNS hijacking flaw affects D-Link DSL router, possibly other devices". Lucian Constantin. Retrieved 2015-01-30.