Details of VAR-202409-1843

ID

VAR-202409-1843

CVE

CVE-2024-38269

TITLE

plural ZyXEL Product vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2024-009433

DESCRIPTION

An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device. wx5600-t0 firmware, wx3401-b0 firmware, wx3100-t0 firmware etc. ZyXEL There are unspecified vulnerabilities in the product.Service operation interruption (DoS) It may be in a state. Zyxel VMG8825-T50K is an Internet access device from China's Zyxel Corporation. Zyxel VMG8825-T50K has a buffer overflow vulnerability, which stems from the USB file sharing handler improperly restricting operations within the memory buffer range

Trust: 2.16

sources: NVD: CVE-2024-38269 // JVNDB: JVNDB-2024-009433 // CNVD: CNVD-2024-40286

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-40286

AFFECTED PRODUCTS

vendor:	zyxel	model:	dx3301-t0	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5510-b0	scope:	lt	version:	5.17\(abqx.10\)c0	Trust: 1.0
vendor:	zyxel	model:	emg5723-t50k	scope:	lt	version:	5.50\(abom.8.4\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3500-t0	scope:	lt	version:	5.44\(achr.2\)c0	Trust: 1.0
vendor:	zyxel	model:	wx3401-b0	scope:	lt	version:	5.17\(abve.2.5\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5601-t0	scope:	lt	version:	5.70\(acdz.3.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5512-t0	scope:	lt	version:	5.70\(aceg.3\)c2	Trust: 1.0
vendor:	zyxel	model:	vmg4005-b60a	scope:	lt	version:	5.17\(abqa.2.2\)c0	Trust: 1.0
vendor:	zyxel	model:	dx3300-t0	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	ex7710-b0	scope:	lt	version:	5.18\(acak.1\)c1	Trust: 1.0
vendor:	zyxel	model:	dx4510-b1	scope:	lt	version:	5.17\(abyl.7\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg8825-t50k	scope:	lt	version:	5.50\(abom.8.4\)c0	Trust: 1.0
vendor:	zyxel	model:	wx3100-t0	scope:	lt	version:	5.50\(abvl.4.3\)c0	Trust: 1.0
vendor:	zyxel	model:	pm7300-t0	scope:	lt	version:	5.42\(abyy.2.2\)c0	Trust: 1.0
vendor:	zyxel	model:	emg5523-t50b	scope:	lt	version:	5.50\(abpm.9.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5401-b0	scope:	lt	version:	5.17\(abyo.6.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3510-b1	scope:	lt	version:	5.17\(abup.12\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3300-t0	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg4005-b50a	scope:	lt	version:	5.17\(abqa.2.2\)c0	Trust: 1.0
vendor:	zyxel	model:	dx3300-t1	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	pm5100-t0	scope:	lt	version:	5.42\(acbf.2.1\)c0	Trust: 1.0
vendor:	zyxel	model:	dx5401-b1	scope:	lt	version:	5.17\(abyo.6.2\)c0	Trust: 1.0
vendor:	zyxel	model:	emg3525-t50b	scope:	lt	version:	5.50\(abpm.9.2\)c0	Trust: 1.0
vendor:	zyxel	model:	px3321-t1	scope:	lt	version:	5.44\(acjb.1\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3301-t0	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	dx4510-b0	scope:	lt	version:	5.17\(abyl.7\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3501-t0	scope:	lt	version:	5.44\(achr.2\)c0	Trust: 1.0
vendor:	zyxel	model:	dx5401-b0	scope:	lt	version:	5.17\(abyo.6.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5401-b1	scope:	lt	version:	5.17\(abyo.6.2\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg3625-t50b	scope:	lt	version:	5.50\(abpm.9.2\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg8623-t50b	scope:	lt	version:	5.50\(abpm.9.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex5601-t1	scope:	lt	version:	5.70\(acdz.3.2\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg3927-t50k	scope:	lt	version:	5.50\(abom.8.4\)c0	Trust: 1.0
vendor:	zyxel	model:	wx5600-t0	scope:	lt	version:	5.70\(aceb.3.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ax7501-b1	scope:	lt	version:	5.17\(abpc.5.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex7501-b0	scope:	lt	version:	5.18\(achn.1.2\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3510-b0	scope:	lt	version:	5.17\(abup.12\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3600-t0	scope:	lt	version:	5.70\(acif.0.3\)c0	Trust: 1.0
vendor:	zyxel	model:	pm3100-t0	scope:	lt	version:	5.42\(acbf.2.1\)c0	Trust: 1.0
vendor:	zyxel	model:	scr50axe	scope:	lt	version:	1.10\(acgn.3\)c0	Trust: 1.0
vendor:	zyxel	model:	ex3300-t1	scope:	lt	version:	5.50\(abvy.5.3\)c0	Trust: 1.0
vendor:	zyxel	model:	vmg3625-t50b	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	wx5600-t0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg3927-t50k	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	wx3100-t0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	emg5523-t50b	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	scr50axe	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg4005-b50a	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	ex7501-b0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg8623-t50b	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg4005-b60a	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	pm7300-t0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	px3321-t1	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg8825-t50k	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	pm3100-t0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	ex7710-b0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	ax7501-b1	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	emg5723-t50k	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	emg3525-t50b	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	wx3401-b0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	pm5100-t0	scope:	-	version:	-	Trust: 0.8
vendor:	zyxel	model:	vmg8825-t50k <=5.50 c0	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2024-40286 // JVNDB: JVNDB-2024-009433 // NVD: CVE-2024-38269

CVSS

SEVERITY

CVSSV2

CVSSV3

security@zyxel.com.tw:	CVE-2024-38269
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2024-009433
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2024-40286
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2024-40286
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:N/AC:L/AU:M/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.4
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

security@zyxel.com.tw:	CVE-2024-38269
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	3.6
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-009433
baseSeverity:	MEDIUM
baseScore:	4.9
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-40286 // JVNDB: JVNDB-2024-009433 // NVD: CVE-2024-38269

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-009433 // NVD: CVE-2024-38269

EXTERNAL IDS

db:	NVD	id:	CVE-2024-38269	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-009433	Trust: 0.8
db:	CNVD	id:	CNVD-2024-40286	Trust: 0.6

sources: CNVD: CNVD-2024-40286 // JVNDB: JVNDB-2024-009433 // NVD: CVE-2024-38269

REFERENCES

url:	https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-memory-corruption-vulnerabilities-in-some-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-security-router-versions-09-24-2024	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-38269	Trust: 1.4

sources: CNVD: CNVD-2024-40286 // JVNDB: JVNDB-2024-009433 // NVD: CVE-2024-38269

SOURCES

db:	CNVD	id:	CNVD-2024-40286
db:	JVNDB	id:	JVNDB-2024-009433
db:	NVD	id:	CVE-2024-38269

LAST UPDATE DATE

2024-10-13T23:13:54.758000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-40286	date:	2024-10-11T00:00:00
db:	JVNDB	id:	JVNDB-2024-009433	date:	2024-10-01T00:47:00
db:	NVD	id:	CVE-2024-38269	date:	2024-09-30T15:51:55.567

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-40286	date:	2024-10-10T00:00:00
db:	JVNDB	id:	JVNDB-2024-009433	date:	2024-10-01T00:00:00
db:	NVD	id:	CVE-2024-38269	date:	2024-09-24T02:15:03.230