This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Zyxel fixes 3 vulnerabilities in its products

Zyxel fixes 3 high-severity vulnerabilities in its products. Information about the specific products and fixed versions can be found at [1]. It is important to note that WAN access is disabled by default and the attack is only possible if a strong administrator password is compromised [1].

Zyxel DSL/Ethernet CPE firmware - post-authentication command injection (CVE-2024-11253)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute operating system commands on the vulnerable device through the "DNSServer" parameter in certain firmware versions of DSL/Ethernet CPE [1][2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-11253 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 3. 2025.

Zyxel DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - post-authentication command injection (CVE-2024-12009)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute operating system commands on the vulnerable device through the "ZyEE" function in certain firmware versions of DSL/Ethernet CPE, fiber ONT and WiFi extenders [1][3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-12009 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 3. 2025.

Zyxel DSL/Ethernet CPE, fiber ONT and WiFi extender firmware - post-authentication command injection (CVE-2024-12010)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can execute operating system commands on the vulnerable device through the "zyUtilMailSend" function in certain firmware versions of DSL/Ethernet CPE, fiber ONT and WiFi extenders [1][4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-12010 at cve.org, NVD
  • CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 3. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 11. 3. 2025.

CESNET, z.s.p.o. Logo