CVE-2024-9677: The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow…

PriorityP344high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.15%

5.0th percentile

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zyxel	uos	< 1.30	1.30
zyxel	usg_flex_h_series_uos_firmware	<= V1.21	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.