Cyber Posture

CVE-2024-12398

High

Published: 14 January 2025

Published
14 January 2025
Modified
21 January 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 56.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12398 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Zyxel Nwa50Ax Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 43.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

AC-6 enforces least privilege by ensuring limited-privilege users cannot access or perform administrator functions like privilege escalation and configuration uploads.

prevent

AC-3 requires the system to enforce approved access control policies, preventing limited users from escalating privileges in the web management interface.

prevent

AC-2 mandates proper management of accounts and privileges, including review and assignment of minimal privileges to mitigate improper privilege management vulnerabilities.

NVD Description

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an…

more

administrator, enabling them to upload configuration files to a vulnerable device.

Deeper analysisAI

CVE-2024-12398 is an improper privilege management vulnerability, classified under CWE-269, affecting the web management interface in Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2). It enables an authenticated user with limited privileges to escalate their access to administrator level, allowing them to upload configuration files to the vulnerable device. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

An attacker requires network access to the web management interface and valid credentials for a limited-privilege account, which could be obtained through weak passwords, prior compromises, or social engineering. Once authenticated, exploitation is straightforward with low complexity and no user interaction needed, leading to privilege escalation. Successful exploitation grants administrator rights, enabling configuration file uploads that could facilitate further persistence, backdoor installation, or full device takeover.

Zyxel has published a security advisory detailing the issue, available at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-aps-and-security-router-devices-01-14-2025, which security practitioners should consult for recommended mitigations and patches.

Details

CWE(s)

Affected Products

zyxel
nwa50ax firmware
≤ 7.10\(abyw.1\)
zyxel
nwa50ax pro firmware
≤ 7.10\(acge.1\)
zyxel
nwa55axe firmware
≤ 7.10\(abzl.1\)
zyxel
nwa90ax firmware
≤ 7.10\(accv.1\)
zyxel
nwa90ax pro firmware
≤ 7.10\(acgf.1\)
zyxel
nwa110ax firmware
≤ 7.10\(abtg.1\)
zyxel
nwa130be firmware
≤ 7.10\(acil.1\)
zyxel
nwa210ax firmware
≤ 7.10\(abtd.1\)
zyxel
nwa220ax-6e firmware
≤ 7.10\(acco.1\)
zyxel
nwa1123acv3 firmware
≤ 6.70\(abvt.6\)
+13 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-13942Same vendor: Zyxel
CVE-2025-0890Same vendor: Zyxel
CVE-2025-8693Same vendor: Zyxel
CVE-2025-13943Same vendor: Zyxel
CVE-2025-7673Same vendor: Zyxel
CVE-2024-40891Same vendor: Zyxel
CVE-2024-40890Same vendor: Zyxel
CVE-2026-1459Same vendor: Zyxel
CVE-2026-2777Shared CWE-269
CVE-2025-0834Shared CWE-269

References