CVE-2024-9677 - The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator

Back Back to CVE browser

HIGH

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator

Published Oct 22, 2024

7.8

HIGH

CVSS 3.1

EPSS 0.15%

Description

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

Affected products

Vendor Zyxel Product USG FLEX H series uOS firmware Default
unaffected
- Version
  <= V1.21
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zyxel

USG FLEX H series uOS firmware

unaffected

Version	Status	Constraints
<= V1.21	affected	-

Vendor Zyxel Product Usg Flex 700h Firmware Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.21

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zyxel

Usg Flex 700h Firmware

unaffected

Version	Status	Constraints
0	affected	<=1.21

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficiently-protected-credentials-vulnerability-in-firewalls-10-22-2024		vendor-advisoryVendor Advisory