high7.2
CVE-2024-9200
A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(…
Impact
A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zyxel | Emg6726-B10a Firmware | before 5.13\(abnp.8\)c1 |
| Zyxel | Vmg3927-B50b Firmware | before 5.13\(ably.9\)c1 |
| Zyxel | Vmg4005-B50a Firmware | before 5.15\(abqa.2.3\)c0 |
| Zyxel | Vmg4005-B60a Firmware | before 5.15\(abqa.2.3\)c0 |
| Zyxel | Vmg4005-B50b Firmware | before 5.13\(abrl.5.2\)c0 |
| Zyxel | Vmg4927-B50a Firmware | before 5.13\(ably.9\)c1 |