Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2024-9677

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated loca

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zyxel

Description

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zyxel USG FLEX H series uOS firmware

Default version status: unaffected

  • <= V1.21affected

References