CVE-2024-11253

CWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGH
EPSS
0.3%
top 45.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Zyxel Vmg8825-t50k FirmwareZyxel Dm4200-b0 FirmwareZyxel Emg5723-t50k Firmware+3 more
Timeline
PublishedMar 11

Description

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(ABOM.8.5)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5zyxel/vmg8825-t50k_firmwareV5.50(ABOM.8.5)C0
▶NVDzyxel/vmg8825-t50k_firmware5.50\(abom.8.5\)c0
▶NVDzyxel/emg5723-t50k_firmware5.50\(abom.8.5\)c0
▶NVDzyxel/vmg3927-t50k_firmware5.50\(abom.8.5\)c0
▶NVDzyxel/dm4200-b0_firmware5.17\(acbs.1\)c0

🔴Vulnerability Details

2
GHSA
GHSA-3gv5-2r5q-m2jj: A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware versi↗2025-03-11
▶
CVEList
CVE-2024-11253: A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware versi↗2025-03-11
▶