PT-2025-10685 · Zyxel · Zyxel Ax7501-B1

Martin Wrona

·

CVE-2024-12010

·

Published

2025-03-11

·

Updated

2025-03-12

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Zyxel AX7501-B1 firmware versions prior to V5.17(ABPC.5.3)C0
Description A post-authentication command injection issue in the zyUtilMailSend function could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.
Recommendations For Zyxel AX7501-B1 firmware versions prior to V5.17(ABPC.5.3)C0, consider disabling the zyUtilMailSend function until a patch is available to prevent potential command injection attacks.

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-05043
CVE-2024-12010

Affected Products

Zyxel Ax7501-B1