Zyxel security advisory for improper privilege management vulnerability in APs
CVE: CVE-2024-1575
Summary
Zyxel has released patches addressing an improper privilege management vulnerability in some access point (AP) versions. Users are advised to install the patches for optimal protection.
What is the vulnerability?
The improper privilege management vulnerability in some Zyxel AP versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device.
What versions are vulnerable—and what should you do?
After a thorough investigation, we’ve identified the vulnerable AP versions that are within their vulnerability support period and released patches to address the vulnerability, as shown in the table below.
| Affected model | Affected version | Patch availability |
|---|---|---|
| NWA50AX | 6.29(ABYW.4) and earlier | 7.00(ABYW.1) |
| NWA50AX-PRO | 6.65(ACGE.1) and earlier | 7.00(ACGE.1) |
| NWA55AXE | 6.29(ABZL.4) and earlier | 7.00(ABZL.1) |
| NWA90AX | 6.29(ACCV.4) and earlier | 7.00(ACCV.1) |
| NWA90AX-PRO | 6.65(ACGF.1) and earlier | 7.00(ACGF.1) |
| NWA110AX | 6.70(ABTG.2) and earlier | 7.00(ABTG.1) |
| NWA210AX | 6.70(ABTD.2) and earlier | 7.00(ABTD.1) |
| NWA220AX-6E | 6.70(ACCO.1) and earlier | 7.00(ACCO.1) |
| NWA1123ACv3 | 6.70(ABVT.1) and earlier | 6.70(ABVT.4) |
| WAC500 | 6.70(ABVS.1) and earlier | 6.70(ABVS.4) |
| WAC500H | 6.70(ABWA.1) and earlier | 6.70(ABWA.4) |
| WAX300H | 6.70(ACHF.1) and earlier | 7.00(ACHF.1) |
| WAX510D | 6.70(ABTF.2) and earlier | 7.00(ABTF.1) |
| WAX610D | 6.70(ABTE.2) and earlier | 7.00(ABTE.1) |
| WAX620D-6E | 6.70(ACCN.1) and earlier | 7.00(ACCN.1) |
| WAX630S | 6.70(ABZD.2) and earlier | 7.00(ABZD.1) |
| WAX640S-6E | 6.70(ACCM.1) and earlier | 7.00(ACCM.1) |
| WAX650S | 6.70(ABRM.2) and earlier | 7.00(ABRM.1) |
| WAX655E | 6.70(ACDO.1) and earlier | 7.00(ACDO.1) |
| WBE660S | 6.70(ACGG.3) and earlier | 7.00(ACGG.1) |
Got a question?
Please contact your local service rep or visit Zyxel’s Community for further information or assistance.
Acknowledgment
Thanks to Alessandro Sgreccia from HackerHood for reporting the issue to us.
Revision history
2024-7-23: Initial release.