CVE-2024-8881

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Nov 12, 2024 / Updated: 8d ago

010
CVSS 6.8EPSS 0.04%Medium
CVE info copied to clipboard

Summary

A post-authentication command injection vulnerability exists in the CGI program of the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier. This vulnerability allows an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.

Impact

If exploited, this vulnerability could lead to severe consequences. An attacker with administrator privileges could execute arbitrary OS commands on the affected Zyxel switch. This could result in: 1. Unauthorized access to sensitive information stored on or passing through the switch. 2. Modification or deletion of critical system files or configurations. 3. Disruption of network services, potentially causing downtime for connected systems. 4. Use of the compromised switch as a stepping stone for further attacks on the network. The impact is heightened by the fact that all three key security properties - confidentiality, integrity, and availability - are rated as "HIGH" in the CVSS score.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the information provided, there is no explicit mention of a patch being available. The vulnerability affects Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier versions. It is recommended to check with Zyxel for the latest firmware updates that may address this vulnerability.

Mitigation

Given the nature of the vulnerability and the absence of a confirmed patch, the following mitigation steps are recommended: 1. Limit administrative access: Restrict administrator privileges to only necessary personnel and enforce strong authentication mechanisms. 2. Network segmentation: Isolate affected switches in a separate network segment to limit potential attack vectors. 3. Monitor for suspicious activity: Implement logging and monitoring for unusual command executions or network activities on the affected switches. 4. Regular firmware updates: Keep the switch firmware up-to-date with the latest versions provided by Zyxel, as they become available. 5. Use of Web Application Firewall (WAF): If possible, implement a WAF to filter out potentially malicious HTTP requests targeting the CGI program. 6. Implement the principle of least privilege: Ensure that administrator accounts have only the necessary permissions required for their roles. 7. Regular security audits: Conduct periodic security assessments to identify and address potential vulnerabilities in the network infrastructure.

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-8881

Nov 12, 2024 at 2:15 AM
First Article

Feedly found the first article mentioning CVE-2024-8881. See article

Nov 12, 2024 at 2:20 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 2:20 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.7%)

Nov 12, 2024 at 9:54 AM
Static CVE Timeline Graph

Affected Systems

Zyxel/gs1900-24_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for post-authentication command injection and buffer overflow vulnerabilities in GS1900 series switches
Summary Zyxel has released patches for GS1900 series switches affected by post-authentication command injection and buffer overflow vulnerabilities. Users are advised to install them for optimal protection. What are the vulnerabilities? CVE-2024-8881 A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900 series switches firmware could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request. CVE-2024-8882 A buffer overflow vulnerability in the CGI program in the Zyxel GS1900 series switches firmware could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service (DoS) conditions via a crafted URL. What versions are vulnerable—and what should you do? After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below. Got a question? Please contact your local service rep or visit Zyxel’s Community for further information or assistance. Acknowledgment Thanks to the following security researchers:

News

Medium - CVE-2024-8881 - A post-authentication command injection...
A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker...
CVE-2024-8881
Medium Severity Description A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request. Read more at https://www.tenable.com/cve/CVE-2024-8881
null
Zyxel - MEDIUM - CVE-2024-8881 A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.
CVE-2024-8881 - Zyxel GS1900-48 Command Injection Vulnerability
CVE ID : CVE-2024-8881 Published : Nov. 12, 2024, 2:15 a.m. 46 minutes ago Description : A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request. Severity: 6.8 MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2024-8881
A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP...
See 5 more articles and social media posts

CVSS V3.1

Attack Vector:Adjacent_network
Attack Complexity:Low
Privileges Required:High
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI