CVE-2024-9200

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-03 · updated 2026-06-17
Weakness: CWE-78

Description

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

Affected products

Zyxel Emg6726-B10A Firmware: before 5.13\(abnp.8\)c1 — fixed in 5.13\(abnp.8\)c1
Zyxel Vmg3927-B50B Firmware: before 5.13\(ably.9\)c1 — fixed in 5.13\(ably.9\)c1
Zyxel VMG4005-B50A firmware: before 5.15\(abqa.2.3\)c0 — fixed in 5.15\(abqa.2.3\)c0
Zyxel VMG4005-B50B firmware: before 5.13\(abrl.5.2\)c0 — fixed in 5.13\(abrl.5.2\)c0
Zyxel Vmg4005-B60A Firmware: before 5.15\(abqa.2.3\)c0 — fixed in 5.15\(abqa.2.3\)c0
Zyxel Vmg4927-B50A Firmware: before 5.13\(ably.9\)c1 — fixed in 5.13\(ably.9\)c1

How to fix

Upgrade to a fixed version: Zyxel Emg6726-B10A Firmware 5.13\(abnp.8\)c1; Zyxel Vmg3927-B50B Firmware 5.13\(ably.9\)c1; Zyxel VMG4005-B50A firmware 5.15\(abqa.2.3\)c0; Zyxel VMG4005-B50B firmware 5.13\(abrl.5.2\)c0; Zyxel Vmg4005-B60A Firmware 5.15\(abqa.2.3\)c0; Zyxel Vmg4927-B50A Firmware 5.13\(ably.9\)c1. Check the vendor advisory for mitigations.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024

Get alerted when CVE-2024-9200 or the next vulnerability affects your stack