PT-2024-38883 · Zyxel · Zyxel Nwa1100-N

Published 2024-08-29 · Updated 2025-01-22 · CVE-2024-8234

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zyxel NWA1100-N version 1.00(AACE.1)C0

Description: A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device. This issue affects the Zyxel NWA1100-N firmware, potentially exposing devices to the risk of full system compromise.

Recommendations: For Zyxel NWA1100-N version 1.00(AACE.1)C0, upgrade to a supported version as soon as possible or apply security mitigations to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable functions formSysCmd(), formUpgradeCert(), and formDelcert() until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-8234

Affected Products

Zyxel Nwa1100-N

References · 12

• 🔥 https://github.com/GroundCTL2MajorTom/pocs · Exploit
• 🔥 https://github.com/GroundCTL2MajorTom/pocs/blob/main/zyxel_NWAW1100-N_rce.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8234 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8234 · Vendor Advisory
• https://webservice.zyxel.com/eol/ArchivedEOLModel.pdf · Note
• https://twitter.com/CVEnew/status/1829324585331757064 · Twitter Post
• https://t.me/cvenotify/92764 · Telegram Post
• https://t.me/latest_high_impact_cve/1080 · Telegram Post
• https://twitter.com/cracbot/status/1831210626682847628 · Twitter Post
• https://t.me/cvedetector/4486 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1829401343355678902 · Twitter Post
• https://twitter.com/oktsec/status/1829417347171410302 · Twitter Post