Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
A post-authentication command injection vulnerability exists in the CGI program of the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier. This vulnerability allows an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.
If exploited, this vulnerability could lead to severe consequences. An attacker with administrator privileges could execute arbitrary OS commands on the affected Zyxel switch. This could result in: 1. Unauthorized access to sensitive information stored on or passing through the switch. 2. Modification or deletion of critical system files or configurations. 3. Disruption of network services, potentially causing downtime for connected systems. 4. Use of the compromised switch as a stepping stone for further attacks on the network. The impact is heightened by the fact that all three key security properties - confidentiality, integrity, and availability - are rated as "HIGH" in the CVSS score.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
As of the information provided, there is no explicit mention of a patch being available. The vulnerability affects Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier versions. It is recommended to check with Zyxel for the latest firmware updates that may address this vulnerability.
Given the nature of the vulnerability and the absence of a confirmed patch, the following mitigation steps are recommended: 1. Limit administrative access: Restrict administrator privileges to only necessary personnel and enforce strong authentication mechanisms. 2. Network segmentation: Isolate affected switches in a separate network segment to limit potential attack vectors. 3. Monitor for suspicious activity: Implement logging and monitoring for unusual command executions or network activities on the affected switches. 4. Regular firmware updates: Keep the switch firmware up-to-date with the latest versions provided by Zyxel, as they become available. 5. Use of Web Application Firewall (WAF): If possible, implement a WAF to filter out potentially malicious HTTP requests targeting the CGI program. 6. Implement the principle of least privilege: Ensure that administrator accounts have only the necessary permissions required for their roles. 7. Regular security audits: Conduct periodic security assessments to identify and address potential vulnerabilities in the network infrastructure.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2024-8881
Feedly found the first article mentioning CVE-2024-8881. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 10.7%)