CVE-2024-11253

Name of the Vulnerable Software and Affected Versions Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.8.5)C0

Description A post-authentication command injection issue exists in the diagnostic function of the Zyxel VMG8825-T50K firmware, specifically in the DNSServer parameter. This could allow an authenticated attacker with administrator privileges to execute operating system commands on a vulnerable device.

Recommendations For Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.8.5)C0, consider restricting access to the diagnostic function until a patch is available. As a temporary workaround, limit the use of the DNSServer parameter to minimize the risk of exploitation.