CVE-2024-38266 Memory corruption in VMG8825-T50K firmware
An authenticated administrator can trigger memory corruption in the Zyxel VMG8825-T50K firmware, causing a thread crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38266?
CVE-2024-38266 is a medium-severity memory corruption vulnerability in Zyxel VMG8825-T50K firmware, published on 24 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device.
Which versions are affected by CVE-2024-38266?
It affects 42 products.
Products include Zyxel Ax7501-B0 Firmware, Zyxel Ax7501-B1 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware, Zyxel Dx4510-B0 Firmware and 36 more.
How do I fix CVE-2024-38266?
No fix has been published for CVE-2024-38266 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-38266 being exploited?
There is no known exploitation of CVE-2024-38266 in the wild and no public exploit code.
Other vulnerabilities in Zyxel VMG8825-T50K firmware
Sources
Also known as GHSA-gqfj-476x-27wc.