CVE-2024-9677
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
- Score
- CVSS 3.1 7.8 High
- Status
- Analyzed - security@zyxel.com.tw
- Published
- 2024-10-22
- Last modified
- 2024-10-22
- Weaknesses
- CWE-522
Affected products
- Uos (Zyxel)
- Usg Flex 100h Firmware (Zyxel)
- Usg Flex 100hp Firmware (Zyxel)
- Usg Flex 200h Firmware (Zyxel)
- Usg Flex 200hp Firmware (Zyxel)
- Usg Flex 500h Firmware (Zyxel)
- Usg Flex 700h Firmware (Zyxel)
- Usg Flex H Series Uos Firmware (Zyxel)
References
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-creden…
