CVE-2024-12398
First published: Tue Jan 14 2025(Updated: )
An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device.
Credit: security@zyxel.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel WBE530 firmware | <=7.00(ACLE.3) | |
| Zyxel WBE660S firmware | <=6.70(ACGG.2) | |
| All of | ||
| Zyxel NWA50AX-Pro firmware | <7.10\(abyw.1\) | |
| Zyxel NWA50AX-PRO | ||
| All of | ||
| Zyxel NWA50AX-PRO | <7.10\(acge.1\) | |
| Zyxel NWA50AX-PRO | ||
| All of | ||
| Zyxel NWA55AXE Firmware | <7.10\(abzl.1\) | |
| Zyxel NWA55AXE Firmware | ||
| All of | ||
| Zyxel NWA90AX Pro Firmware | <7.10\(accv.1\) | |
| Zyxel NWA90AX Firmware | ||
| All of | ||
| Zyxel NWA90AX-PRO Firmware | <7.10\(acgf.1\) | |
| Zyxel NWA90AX Pro Firmware | ||
| All of | ||
| Zyxel NWA110AX | <7.10\(abtg.1\) | |
| Zyxel NWA110AX firmware | ||
| All of | ||
| Zyxel NWA130BE Firmware | <7.10\(acil.1\) | |
| Zyxel NWA130BE Firmware | ||
| All of | ||
| Zyxel NWA210AX | <7.10\(abtd.1\) | |
| Zyxel NWA210AX Firmware | ||
| All of | ||
| Zyxel NWA220AX-6E Firmware | <7.10\(acco.1\) | |
| Zyxel NWA220AX-6E Firmware | ||
| All of | ||
| Zyxel NWA1123-AC PRO firmware | <6.70\(abvt.6\) | |
| Zyxel NWA1123-AC PRO firmware | ||
| All of | ||
| Zyxel WAC500H Firmware | <6.70\(abvs.6\) | |
| Zyxel WAC500 firmware | ||
| All of | ||
| Zyxel WAC500H Firmware | <6.70\(abwa.6\) | |
| Zyxel WAC500H Firmware | ||
| All of | ||
| Zyxel WAX300H | <7.10\(achf.1\) | |
| Zyxel WAX300H firmware | ||
| All of | ||
| Zyxel WAX510D firmware | <7.10\(abtf.1\) | |
| Zyxel WAX510D firmware | ||
| All of | ||
| Zyxel WAX610D | <7.10\(abte.1\) | |
| Zyxel WAX610D Firmware | ||
| All of | ||
| Zyxel WAX620D-6E | <7.10\(accn.1\) | |
| Zyxel WAX620D-6E Firmware | ||
| All of | ||
| Zyxel WAX630S Firmware | <7.10\(abzd.1\) | |
| Zyxel WAX630S Firmware | ||
| All of | ||
| Zyxel WAX640S-6E | <7.10\(accm.1\) | |
| Zyxel WAX640S-6E Firmware | ||
| All of | ||
| Zyxel WAX650S Firmware | <7.10\(abrm.1\) | |
| Zyxel WAX650S Firmware | ||
| All of | ||
| Zyxel WAX655E Firmware | <7.10\(acdo.1\) | |
| Zyxel WAX655E Firmware | ||
| All of | ||
| Zyxel WBE530 Firmware | <7.10\(acle.1\) | |
| Zyxel WBE530 firmware | ||
| All of | ||
| Zyxel WBE660S firmware | <7.00\(acgg.1\) | |
| Zyxel WBE660S firmware | ||
| All of | ||
| Zyxel USG LITE 60AX firmware | <2.10\(acip.0\) | |
| Zyxel USG LITE 60AX firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-12398?
The severity of CVE-2024-12398 is considered high due to its ability to allow privilege escalation for authenticated users.
How do I fix CVE-2024-12398?
To mitigate CVE-2024-12398, update the firmware of affected Zyxel devices to the latest version that is not vulnerable.
Which Zyxel devices are affected by CVE-2024-12398?
CVE-2024-12398 affects Zyxel WBE530 firmware versions up to 7.00(ACLE.3) and WBE660S firmware versions up to 6.70(ACGG.2).
Can CVE-2024-12398 be exploited remotely?
CVE-2024-12398 requires authenticated access, meaning an attacker must have some level of user access to exploit this vulnerability.
What are the potential consequences of CVE-2024-12398?
Exploitation of CVE-2024-12398 may lead to unauthorized access to administrative functions and control over the affected network devices.
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/zyxel
- canonical/zyxel wbe530 firmware
- canonical/zyxel wbe660s firmware
- canonical/zyxel nwa50ax-pro firmware
- canonical/zyxel nwa50ax-pro
- canonical/zyxel nwa55axe firmware
- canonical/zyxel nwa90ax pro firmware
- canonical/zyxel nwa90ax firmware
- canonical/zyxel nwa90ax-pro firmware
- canonical/zyxel nwa110ax
- canonical/zyxel nwa110ax firmware
- canonical/zyxel nwa130be firmware
- canonical/zyxel nwa210ax
- canonical/zyxel nwa210ax firmware
- canonical/zyxel nwa220ax-6e firmware
- canonical/zyxel nwa1123-ac pro firmware
- canonical/zyxel wac500h firmware
- canonical/zyxel wac500 firmware
- canonical/zyxel wax300h
- canonical/zyxel wax300h firmware
- canonical/zyxel wax510d firmware
- canonical/zyxel wax610d
- canonical/zyxel wax610d firmware
- canonical/zyxel wax620d-6e
- canonical/zyxel wax620d-6e firmware
- canonical/zyxel wax630s firmware
- canonical/zyxel wax640s-6e
- canonical/zyxel wax640s-6e firmware
- canonical/zyxel wax650s firmware
- canonical/zyxel wax655e firmware
- canonical/zyxel usg lite 60ax firmware