CVE-2024-1575 Privilege escalation in WBE660S firmware

What is CVE-2024-1575?

CVE-2024-1575 is a medium-severity vulnerability in Zyxel WBE660S firmware, published on 23 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device.

Weakness: CWE-269

Which versions are affected by CVE-2024-1575?

It affects 20 products.

Products include Zyxel Nwa110ax Firmware, Zyxel Nwa1123acv3 Firmware, Zyxel Nwa210ax Firmware, Zyxel Nwa220ax-6e Firmware, Zyxel Nwa50ax-Pro Firmware, Zyxel Nwa50ax Firmware and 14 more.

How do I fix CVE-2024-1575?

No fix has been published for CVE-2024-1575 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-1575 being exploited?

There is no known exploitation of CVE-2024-1575 in the wild and no public exploit code.

Other vulnerabilities in Zyxel WBE660S firmware

• CVE-2024-7261 Command injection in NWA1123ACv3 firmware Critical 9.8
• CVE-2024-12398 Privilege escalation in WBE530 firmware High 8.8
• CVE-2025-6265 Path traversal in NWA50AX PRO firmware High 7.2
• CVE-2023-37925 Privilege escalation in ATP series firmware Medium 5.5
• CVE-2023-5797 Privilege escalation in ATP series firmware Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w52f-78r3-v89r.