CVE-2024-42059

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Sep 3, 2024 / Updated: 2mo ago

010
CVSS 7.2EPSS 0.05%High
CVE info copied to clipboard

Summary

A post-authentication command injection vulnerability exists in multiple Zyxel firewall product lines and firmware versions. This vulnerability affects ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.00 through V5.38, and USG20(W)-VPN series firmware versions V5.00 through V5.38. The vulnerability allows an authenticated attacker with administrator privileges to execute arbitrary OS commands on an affected device by uploading a crafted compressed language file via FTP.

Impact

If exploited, this vulnerability could lead to severe consequences. An attacker with administrator privileges could execute arbitrary OS commands on the affected Zyxel devices. This could result in complete compromise of the device, potentially leading to: 1. Unauthorized access to sensitive information 2. Modification or destruction of data 3. Disruption of network services 4. Use of the compromised device as a pivot point for further attacks on the network The vulnerability has a CVSS v3.1 base score of 7.2 (High), with high impacts on confidentiality, integrity, and availability. This indicates that successful exploitation could significantly affect the organization's data and operations.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Zyxel has released security updates to address this vulnerability. The patch information was added on September 5, 2024, and can be found on the Zyxel website: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024

Mitigation

To mitigate this vulnerability, the following steps are recommended: 1. Immediately update affected Zyxel devices to the latest firmware versions (V5.39 or later) which contain the security fix. 2. If immediate patching is not possible, implement strict access controls to limit who can access the administrator interface of these devices. 3. Monitor logs for any suspicious FTP activities or file uploads, especially those related to language files. 4. Implement network segmentation to isolate affected devices if they cannot be immediately patched. 5. Regularly review and audit administrator accounts to ensure only necessary personnel have elevated privileges. 6. Consider implementing additional network security measures such as intrusion detection/prevention systems (IDS/IPS) to monitor for potential exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-42059

Sep 3, 2024 at 2:15 AM
First Article

Feedly found the first article mentioning CVE-2024-42059. See article

Sep 3, 2024 at 2:16 AM / Zyxel
Threat Intelligence Report

CVE-2024-42059 is a critical post-authentication command injection vulnerability in Zyxel firewalls that could allow an authenticated attacker to execute OS commands. This vulnerability has been acknowledged by security researchers and patches have been released by Zyxel to address it. It is important for organizations to apply the patches promptly to prevent potential exploitation by malicious actors. See article

Sep 3, 2024 at 2:16 AM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 3, 2024 at 2:21 AM
EPSS

EPSS Score was set to: 0.05% (Percentile: 21.1%)

Sep 3, 2024 at 9:38 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (206736)

Sep 6, 2024 at 9:18 PM
Static CVE Timeline Graph

Affected Systems

Zyxel/zld_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for multiple vulnerabilities in firewalls
CVE-2024-42060 A post-authentication command injection vulnerability in some firewall versions could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. CVE-2024-42059 A post-authentication command injection vulnerability in some firewall versions could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP.

News

Zyxel Patches Critical OS Command Injection Flaw in Access Points and Routers
CVE-2024-6343 (CVSS score: 4.9) – A buffer overflow vulnerability that could allow an authenticated attacker with administrator privileges to trigger DoS conditions by means of a specially crafted HTTP request CVE-2024-5412 (CVSS score: 7.5) – A buffer overflow vulnerability in the “libclinkc” library that could allow an unauthenticated attacker to cause DoS conditions by means of a specially crafted HTTP request
Zyxel firewalls with highly dangerous security vulnerabilities
A post-authentication command prompt vulnerability in some firewall versions could allow an authenticated attacker with administrative privileges to execute certain operating system commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. A vulnerability in some firewall versions that allows command entry after authentication could allow an authenticated attacker with administrative privileges to execute certain operating system commands on an affected device by uploading a crafted compressed language file via FTP.
Zyxel firewalls with highly dangerous security vulnerabilities
A post-authentication command prompt vulnerability in some firewall versions could allow an authenticated attacker with administrative privileges to execute certain operating system commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. A vulnerability in some firewall versions that allows command entry after authentication could allow an authenticated attacker with administrative privileges to execute certain operating system commands on an affected device by uploading a crafted compressed language file via FTP.
Zyxel Patches Critical OS Command Injection Flaw in Access Points and Routers
CVE-2024-6343 (CVSS score: 4.9) – A buffer overflow vulnerability that could allow an authenticated attacker with administrator privileges to trigger DoS conditions by means of a specially crafted HTTP request CVE-2024-5412 (CVSS score: 7.5) – A buffer overflow vulnerability in the “libclinkc” library that could allow an unauthenticated attacker to cause DoS conditions by means of a specially crafted HTTP request
Zyxel USG FLEX 5.00 < 5.39 / ATP 5.00 < 5.39 Command Injection
Nessus Plugin ID 206736 with High Severity Synopsis The remote security gateway is affected by a command injection vulnerability. Description The Firmware version of the Zyxel USG / ATP device is affected by a post-authentication command injection vulnerability in some firewall versions could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP. (CVE-2024-42059) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Solution Upgrade to Zyxel USG FLEX / ATP to version 5.39 or later. Read more at https://www.tenable.com/plugins/nessus/206736
See 33 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI