CVE-2024-9677

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9677
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:zyxel:uos:*:*:*:*:*:*:*:*
OR cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*
History

05 Dec 2024, 22:11

Type Values Removed Values Added
CPE cpe:2.3:h:zyxel:usg_flex_100h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200hp:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_700h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_200h:-:*:*:*:*:*:*:*
cpe:2.3:h:zyxel:usg_flex_500h:-:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:uos:*:*:*:*:*:*:*:*
First Time Zyxel usg Flex 200hp
Zyxel usg Flex 500h
Zyxel usg Flex 700h
Zyxel uos
Zyxel usg Flex 200h
Zyxel
Zyxel usg Flex 100h
References () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024 - () https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024 - Vendor Advisory

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de credenciales insuficientemente protegidas en el comando CLI de la versión de firmware uOS V1.21 y versiones anteriores de la serie USG FLEX H podría permitir que un atacante local autenticado obtenga una escalada de privilegios al robar el token de autenticación de un administrador que inició sesión. Tenga en cuenta que este ataque podría tener éxito solo si el administrador no ha cerrado sesión.

22 Oct 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-22 02:15

Updated : 2024-12-05 22:11

NVD link : CVE-2024-9677

Mitre link : CVE-2024-9677

CVE.ORG link : CVE-2024-9677

JSON object : View

Products Affected

zyxel

  • usg_flex_200h
  • usg_flex_500h
  • usg_flex_100h
  • usg_flex_200hp
  • uos
  • usg_flex_700h
CWE
CWE-522

Insufficiently Protected Credentials