USG FLEX / ATP Series – Recovery Steps for Application Signature Issue on January 24th

Quelle: Link

Please read the complete article carefully before driving on-site and ensure you have the required cable!

We will offer a „Teams“ Open Question Session on Saturday January 25th from 9am – 12pm and 1pm – 5pm (GMT +1). A Support Agent will be available in this call, answer your questions. The Session will be in English language only. You can send Chat messages in local language.
Please join the session at this time HERE (Open 1/25)

We’ve found an issue affecting a few devices that may cause reboot loops, ZySH daemon failures, or login access problems. The system LED may also flash. Please note this is not related to a CVE or security issue.

The issue stems from a failure in the Application Signature Update, not a firmware upgrade. To address this, we’ve disabled the application signature on our servers, preventing further impact on firewalls that haven’t loaded the new signature versions.

Device Error: Wrong CLI command, device timeout or device logout.
Unable to login to ATP/USG FLEX via web GUI: 504 Gateway timeout.
CPU usage is high.
In Monitor > Log, the message „ZySH daemon is busy“ appeared.
Unable to enter any commands on console.
Coredump messages appear on console.

Which devices are affected?

Devices with active security licenses on USG FLEX or ATP Series (ZLD Firmware Versions) and dedicated signature updates in On-premise/Standalone Mode (signature updated 1/24 to 1/25 in the night).
Devices on Nebula platform or USG FLEX H (uOS) series are NOT affected.

The only fully verified solution is as follows; please follow these steps:
(If your system running in Device-HA Mode, please be in touch with Support directly.)

This recovery requires a console cable and must be done on-site. While it’s not ideal, it’s the only guaranteed solution for this issue.

A recovery by SSH, FTP or Webinterface isn´t doable.