« Volver al listado

CVE-2024-8234

Estado: AnalizadaCrítica (9.8)—

** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the Zyxel NWA1100-N firmware version 1.00(AACE.1)C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zyxel — Nwaw1100-n Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8234",
  "cveTags": [
    {
      "tags": [
        "unsupported-when-assigned"
      ],
      "sourceIdentifier": "security@zyxel.com.tw"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8234",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-30T14:51:56.726566Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zyxel.com.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@zyxel.com.tw",
      "affectedData": [
        {
          "vendor": "Zyxel",
          "product": "NWA1100-N firmware",
          "versions": [
            {
              "status": "affected",
              "version": "1.00(AACE.1)C0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:zyxel:nwa1100-n_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "zyxel",
          "product": "nwa1100-n_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "1.00(AACE.1)C0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-30T01:15:03.797",
  "references": [
    {
      "url": "https://github.com/GroundCTL2MajorTom/pocs/blob/main/zyxel_NWAW1100-N_rce.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@zyxel.com.tw"
    },
    {
      "url": "https://webservice.zyxel.com/eol/ArchivedEOLModel.pdf",
      "tags": [
        "Product"
      ],
      "source": "security@zyxel.com.tw"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zyxel.com.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the Zyxel NWA1100-N firmware version 1.00(AACE.1)C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device."
    },
    {
      "lang": "es",
      "value": "**NO COMPATIBLE CUANDO SE ASIGNÓ** Una vulnerabilidad de inyección de comandos en las funciones formSysCmd(), formUpgradeCert() y formDelcert() en la versión de firmware 1.00(AACE.1)C0 de Zyxel NWA1100-N podría permitir que un atacante no autenticado ejecute algunos comandos del sistema operativo para acceder a archivos del sistema en un dispositivo afectado."
    }
  ],
  "lastModified": "2026-06-17T08:22:10.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zyxel:nwaw1100-n_firmware:1.00\\(aace.1\\)c0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A287BAD0-E7E6-4767-AB55-C7F7F7A2B4F0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zyxel:nwaw1100-n:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D2977534-61B0-4665-B547-8B422E2F3603"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@zyxel.com.tw"
}