CVE-2024-8748 Memory corruption in VMG8825-T50K firmware

High 7.5 Published 3 Dec 2024 Updated 3 Dec 2024

A buffer overflow in the packet parser allows attackers to cause a temporary denial of service on the web management interface via crafted HTTP requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-8748?

CVE-2024-8748 is a high-severity memory corruption vulnerability in Zyxel VMG8825-T50K firmware, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an attacker to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP POST request to a vulnerable device.

Weakness: CWE-120

Which versions are affected by CVE-2024-8748?

It affects 63 products.

Products include Zyxel Ax7501-B0 Firmware, Zyxel Ax7501-B1 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware, Zyxel Dx4510-B0 Firmware and 57 more.

How do I fix CVE-2024-8748?

No fix has been published for CVE-2024-8748 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-8748 being exploited?

There is no known exploitation of CVE-2024-8748 in the wild and no public exploit code.

Sources

Also known as GHSA-5q23-39rg-fgrp.