PT-2024-8144 · Zyxel · Zyxel Gs1900-48

Chengchao Ai · Published 2024-11-12 · Updated 2024-11-14 · CVE-2024-8881

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier

Description: A post-authentication command injection issue in the CGI program of the Zyxel GS1900-48 switch firmware could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request. The vulnerability is related to the failure to neutralize special elements used in an OS command.

Recommendations: For Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier, consider disabling the CGI program temporarily as a workaround until a patch is available. Restrict access to the CGI interface to minimize the risk of exploitation. Avoid using the vulnerable firmware version until an update is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-09685

CVE-2024-8881

Affected Products

Zyxel Gs1900-48

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-8881 · Security Note
• https://bdu.fstec.ru/vul/2024-09685 · Security Note
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8881 · Vendor Advisory
• https://t.me/cvenotify/101680 · Telegram Post
• https://t.me/cvedetector/10567 · Telegram Post
• https://t.me/cvenotify/101337 · Telegram Post