CVE-2024-9677: The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow…

high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zyxel	uos	< 1.30	1.30
zyxel	usg_flex_h_series_uos_firmware	<= V1.21	—