CVE-2024-9677: High severity zyxel uos vulnerability
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9677?
CVE-2024-9677 is classified with a severity rating that indicates the potential for privilege escalation due to insufficiently protected credentials.
How do I fix CVE-2024-9677?
To remediate CVE-2024-9677, it is advised to upgrade the USG FLEX H series uOS firmware to version 1.30 or later.
Who is affected by CVE-2024-9677?
The vulnerability CVE-2024-9677 affects users of the USG FLEX H series devices running uOS firmware version V1.21 and earlier.
What type of attack does CVE-2024-9677 facilitate?
CVE-2024-9677 allows an authenticated local attacker to perform privilege escalation by stealing the authentication token of an administrator.
Is my device vulnerable to CVE-2024-9677?
You would be vulnerable to CVE-2024-9677 if your USG FLEX H series device is using uOS firmware version V1.21 or earlier.