medium4.9
CVE-2024-9197
A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2…
Impact
A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Dx3300-T0 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Dx3300-T1 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Dx3301-T0 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Dx4510-B0 Firmware | before 5.17\(abyl.8\)c0 |
| Zyxel | Dx4510-B1 Firmware | before 5.17\(abyl.8\)c0 |
| Zyxel | Dx5401-B0 Firmware | before 5.17\(abyo.6.4\)c0 |
| Zyxel | Dx5401-B1 Firmware | before 5.17\(abyo.6.4\)c0 |
| Zyxel | Ee6510-10 Firmware | before 5.19\(acjq.1\)c0 |
| Zyxel | Ex3300-T0 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Ex3300-T1 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Ex3301-T0 Firmware | before 5.50\(aby.5.4\)c0 |
| Zyxel | Ex3500-T0 Firmware | before 5.44\(achr.3\)c0 |