CVE-2020-24355

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Incorrect Permission Assignment for Critical Resource pada zyxel vmg5313-b30b firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.

Rincian

Terbit di NVD

2 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zyxel.com/support/security_advisories.shtml advisory vendor
• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B exploit · advisory pihak ketiga
• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2 exploit · advisory pihak ketiga