CVE-2024-11253
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: security@zyxel.com.tw (Secondary)
Description
A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(ABOM.8.5)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.
Affected (6)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.50\(abom.8.5\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Emg5723 T50k | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.17\(acbs.1\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Dm4200 B0 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.50\(abom.8.5\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Vmg3927 T50k | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.15\(abqa.2.3\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Vmg4005 B50a | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.15\(abqa.2.3\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Vmg4005 B60a | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.50\(abom.8.5\)c0 |
| Running on/with | Platform Versions |
|---|---|
Zyxel Vmg8825 T50k | All versions |
References (1)
Timeline
No history available yet.