CVE-2024-9197

CWE-120 — Classic Buffer Overflow3 documents3 sources

Severity

4.9MEDIUM

EPSS

0.4%

top 40.21%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zyxel Ax7501-b0 Firmware Zyxel Ax7501-b1 Firmware Zyxel Dx3300-t0 Firmware +33 more

Timeline

PublishedDec 3

Description

A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 1.2 | Impact: 3.6

Affected Packages37 packages

▶NVDzyxel/vmg3625-t50b_firmware< 5.50\(abpm.9.3\)c0

▶CVEListV5zyxel/vmg3625-t50b_firmwareV5.50(ABPM.9.2)C0

▶NVDzyxel/emg3525-t50b_firmware< 5.50\(abpm.9.3\)c0

▶NVDzyxel/emg5523-t50b_firmware< 5.50\(abpm.9.3\)c0

▶NVDzyxel/vmg8623-t50b_firmware< 5.50\(abpm.9.3\)c0

🔴Vulnerability Details

GHSA

GHSA-xf8q-6qq2-4pq3: A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5↗2024-12-03

▶

CVEList

CVE-2024-9197: A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5↗2024-12-03

▶