Cyber Resilience

CVE-2024-12010

HighRCE

Published: 11 March 2025

Published
11 March 2025
Modified
11 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 55.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12010 is a high-severity OS Command Injection (CWE-78) vulnerability in Zyxel AX7501-B1 (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-12010 is a post-authentication command injection vulnerability (CWE-78) in the zyUtilMailSend function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.

An authenticated attacker with administrator privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation enables execution of arbitrary operating system commands on the vulnerable device.

The Zyxel security advisory provides details on mitigation: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerabilities-in-certain-dsl-ethernet-cpe-fiber-ont-and-wifi-extender-devices-03-11-2025.

EU & UK References

Vulnerability details

A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Post-auth command injection (CWE-78) in network device firmware directly enables remote arbitrary OS command execution after admin auth, mapping to T1190 (exploiting public-facing app) and T1059.004 (Unix shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42454Shared CWE-78
CVE-2026-34796Shared CWE-78
CVE-2026-40111Shared CWE-78
CVE-2024-57016Shared CWE-78
CVE-2019-25224Shared CWE-78
CVE-2025-50475Shared CWE-78
CVE-2024-57015Shared CWE-78
CVE-2026-36828Shared CWE-78
CVE-2024-57595Shared CWE-78
CVE-2026-25196Shared CWE-78

Affected Assets

Zyxel
AX7501-B1
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Information input validation directly prevents command injection by sanitizing user inputs to the zyUtilMailSend function before OS command execution.

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching of the specific command injection vulnerability in the Zyxel AX7501-B1 firmware.

AC-6 Least Privilege partial match
prevent

Least privilege restricts administrator accounts from executing arbitrary OS commands, limiting the impact of successful exploitation.

References