Zyxel USG FLEX H uOS up to 1.21 CLI insufficiently protected credentials

Summaryinfo

A vulnerability identified as problematic has been detected in Zyxel USG FLEX H uOS up to 1.21. This affects an unknown function of the component CLI. The manipulation leads to insufficiently protected credentials. This vulnerability is referenced as CVE-2024-9677. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in Zyxel USG FLEX H uOS up to 1.21. It has been rated as problematic. This issue affects some unknown functionality of the component CLI. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. Using CWE to declare the problem leads to CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Impacted is confidentiality. The summary by CVE is:

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

The advisory is shared at zyxel.com. The identification of this vulnerability is CVE-2024-9677 since 10/09/2024. The exploitation is known to be easy. An attack has to be approached locally. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Zyxel

Name

• USG FLEX H uOS

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21

License

• commercial

Website

• Vendor: https://www.zyxel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion