PT-2024-39223 · Zyxel · Zyxel Vmg8825-T50K

Dawid Kulikowski · Published 2024-12-03 · Updated 2025-01-21 · CVE-2024-8748

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0

Description: A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" could allow an attacker to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP POST request to a vulnerable device.

Recommendations: For Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0, consider disabling the web management interface until a patch is available to prevent exploitation of the buffer overflow vulnerability in the "libclinkc" library. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-8748

Affected Products

Zyxel Vmg8825-T50K

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-8748 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8748 · Vendor Advisory
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024 · Vendor Advisory
• https://twitter.com/cracbot/status/1865637477664567302 · Twitter Post
• https://t.me/cvedetector/11846 · Telegram Post
• https://t.me/cvenotify/102865 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1864121549122621720 · Twitter Post
• https://t.me/cvenotify/108149 · Telegram Post
• https://t.me/latest_high_impact_cve/1603 · Telegram Post
• https://twitter.com/CVEnew/status/1863776214261109081 · Twitter Post