Vulnerability · Published Sep 2, 2020 · Assigned by mitre

CVE-2020-24355

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.2%top 17.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.zyxel.com/support/security_advisories.shtml x_refsource_MISC
https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B x_refsource_MISC
https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2 x_refsource_MISC