What’s Vulnerable › Vulnerabilities

CVE-2020-24355

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-02 · updated 2026-06-17
• Weakness: CWE-732

Description

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.

Affected products

• Zyxel Vmg5313-B30B Firmware: through 5.13\(abcj.6\)b3_1127

References

• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2
• https://www.zyxel.com/support/security_advisories.shtml
• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
• https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2
• https://www.zyxel.com/support/security_advisories.shtml

Get alerted when CVE-2020-24355 or the next vulnerability affects your stack