Description
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zyxel | USG FLEX H series uOS firmware | <= V1.21 | — |
Advisories 1
- WID-SEC-2024-3247 Zyxel Firewall: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Oct 21, 2024