CVE-2024-11253

published 2025-03-11

CVE-2024-11253: A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version…

Priority P3 48 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(ABOM.8.5)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
zyxel	dm4200-b0_firmware	<= 5.17\(acbs.1\)c0	—
zyxel	emg5723-t50k_firmware	<= 5.50\(abom.8.5\)c0	—
zyxel	vmg3927-t50k_firmware	<= 5.50\(abom.8.5\)c0	—
zyxel	vmg4005-b50a_firmware	<= 5.15\(abqa.2.3\)c0	—
zyxel	vmg4005-b60a_firmware	<= 5.15\(abqa.2.3\)c0	—
zyxel	vmg8825-t50k_firmware	<= 5.50\(abom.8.5\)c0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78