CVE-2024-8881

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-12 · updated 2026-06-17
Weakness: CWE-78

Description

A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.

Affected products

Zyxel GS1900-10HP firmware: before 2.90\(aazi.0\)c0 — fixed in 2.90\(aazi.0\)c0
Zyxel GS1900-16 firmware: before 2.90\(aahj.0\)c0 — fixed in 2.90\(aahj.0\)c0
Zyxel GS1900-24 firmware: before 2.90\(aahl.0\)c0 — fixed in 2.90\(aahl.0\)c0
Zyxel GS1900-24E firmware: before 2.90\(aahk.0\)c0 — fixed in 2.90\(aahk.0\)c0
Zyxel GS1900-24EP firmware: before 2.90\(abto.0\)c0 — fixed in 2.90\(abto.0\)c0
Zyxel GS1900-24HPv2 firmware: before 2.90\(abtp.0\)c0 — fixed in 2.90\(abtp.0\)c0
Zyxel GS1900-48 firmware: before 2.90\(aahn.0\)c0 — fixed in 2.90\(aahn.0\)c0
Zyxel GS1900-48HPv2 firmware: before 2.90\(abtq.0\)c0 — fixed in 2.90\(abtq.0\)c0
Zyxel GS1900-8 firmware: before 2.90\(aahh.0\)c0 — fixed in 2.90\(aahh.0\)c0
Zyxel GS1900-8HP firmware: before 2.90\(aahi.0\)c0 — fixed in 2.90\(aahi.0\)c0

How to fix

Upgrade to a fixed version: Zyxel GS1900-10HP firmware 2.90\(aazi.0\)c0; Zyxel GS1900-16 firmware 2.90\(aahj.0\)c0; Zyxel GS1900-24 firmware 2.90\(aahl.0\)c0; Zyxel GS1900-24E firmware 2.90\(aahk.0\)c0; Zyxel GS1900-24EP firmware 2.90\(abto.0\)c0; Zyxel GS1900-24HPv2 firmware 2.90\(abtp.0\)c0; Zyxel GS1900-48 firmware 2.90\(aahn.0\)c0; Zyxel GS1900-48HPv2 firmware 2.90\(abtq.0\)c0; Zyxel GS1900-8 firmware 2.90\(aahh.0\)c0; Zyxel GS1900-8HP firmware 2.90\(aahi.0\)c0. Check the vendor advisory for mitigations.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024

Get alerted when CVE-2024-8881 or the next vulnerability affects your stack