CVE-2024-12398

HIGH
2025-01-14 [email protected]
8.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:03 vuln.today
CVE Published
Jan 14, 2025 - 02:15 nvd
HIGH 8.8

Tags

Privilege Escalation Zyxel Nwa50Ax Firmware Nwa50Ax Pro Firmware Nwa55Axe Firmware Nwa90Ax Firmware Nwa90Ax Pro Firmware Nwa110Ax Firmware Nwa130Be Firmware Nwa210Ax Firmware Nwa220Ax 6E Firmware Nwa1123Acv3 Firmware Wac500 Firmware Wac500H Firmware Wax300H Firmware Wax510D Firmware Wax610D Firmware Wax620D 6E Firmware Wax630S Firmware Wax640S 6E Firmware Wax650S Firmware Wax655E Firmware Wbe530 Firmware Wbe660S Firmware Usg Lite 60Ax Firmware

Description

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device.

Analysis

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical Context

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device. Affected products include: Zyxel Nwa50Ax Firmware, Zyxel Nwa50Ax Pro Firmware, Zyxel Nwa55Axe Firmware, Zyxel Nwa90Ax Firmware, Zyxel Nwa90Ax Pro Firmware. Version information: through 7.00.

Affected Products

Zyxel Nwa50Ax Firmware, Zyxel Nwa50Ax Pro Firmware, Zyxel Nwa55Axe Firmware, Zyxel Nwa90Ax Firmware, Zyxel Nwa90Ax Pro Firmware.

Remediation

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: +0.3
CVSS: +44
POC: 0

Share

CVE-2024-12398 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy