What is the CVSS score of CVE-2024-12398?

CVE-2024-12398 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Nwa50Ax Firmware are affected by CVE-2024-12398?

Organizations using the web management interface of the Zyxel WBE530 firmware face significant risk from CVE-2024-12398, a improper privilege management vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2024-12398?

Within 30 days: Identify all affected systems running the web management interface of the Zyxel WBE530 firmware and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Nwa50Ax Firmware CVE-2024-12398

HIGH

Improper Privilege Management (CWE-269)

2025-01-14 security@zyxel.com.tw

Privilege Escalation Zyxel Nwa50Ax Firmware Nwa50Ax Pro Firmware Nwa55Axe Firmware Nwa90Ax Firmware Nwa90Ax Pro Firmware Nwa110Ax Firmware Nwa130Be Firmware Nwa210Ax Firmware Nwa220Ax 6E Firmware Nwa1123Acv3 Firmware Wac500 Firmware Wac500H Firmware Wax300H Firmware Wax510D Firmware Wax610D Firmware Wax620D 6E Firmware Wax630S Firmware Wax640S 6E Firmware Wax650S Firmware Wax655E Firmware Wbe530 Firmware Wbe660S Firmware Usg Lite 60Ax Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:03 vuln.today

CVE Published

Jan 14, 2025 - 02:15 nvd

HIGH 8.8

DescriptionCVE.org

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device.

AnalysisAI

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device. Affected products include: Zyxel Nwa50Ax Firmware, Zyxel Nwa50Ax Pro Firmware, Zyxel Nwa55Axe Firmware, Zyxel Nwa90Ax Firmware, Zyxel Nwa90Ax Pro Firmware. Version information: through 7.00.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.