This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Zyxel fixes 3 vulnerabilities in multiple products
Zyxel is fixing 3 vulnerabilities found in 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONT and WiFi extender products. The products and their fixed versions can be found in the tables at [1].
Allows an unauthenticated remote attacker, by sending a forged HTTP POST request, to carry out a DoS attack on the web management interface [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-8748 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 3. 12. 2024.
Allows an authenticated remote attacker with administrator privileges, by sending a forged HTTP GET request when the ZyEE function is enabled, to carry out a DoS attack on the web management interface [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-9197 at cve.org, NVD
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 3. 12. 2024.
Allows an authenticated remote attacker with administrator privileges to execute operating system commands [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-9200 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 3. 12. 2024.
By CESNET, z.s.p.o. Michaela Jarošová on 3. 12. 2024.