CVE-2024-9197 Memory corruption in VMG3625-T50B firmware

Medium 4.9 Published 3 Dec 2024 Updated 3 Dec 2024

An authenticated administrator can cause a temporary denial of service on the web interface via a buffer overflow if ZyEE is enabled.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-9197?

CVE-2024-9197 is a medium-severity memory corruption vulnerability in Zyxel VMG3625-T50B firmware, published on 3 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.

Weakness: CWE-120

Which versions are affected by CVE-2024-9197?

It affects 36 products.

Products include Zyxel Ax7501-B0 Firmware, Zyxel Ax7501-B1 Firmware, Zyxel Dx3300-T0 Firmware, Zyxel Dx3300-T1 Firmware, Zyxel Dx3301-T0 Firmware, Zyxel Dx4510-B0 Firmware and 30 more.

How do I fix CVE-2024-9197?

No fix has been published for CVE-2024-9197 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-9197 being exploited?

There is no known exploitation of CVE-2024-9197 in the wild and no public exploit code.

Sources

Also known as GHSA-xf8q-6qq2-4pq3.