What is CVE-2020-24355?

CVE-2020-24355 is a critical-severity vulnerability in Zyxel Vmg5313-B30b, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 9.8/10. Published 2020-09-02.

How severe is CVE-2020-24355?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-24355 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Zyxel Vmg5313-B30b

CVE-2020-24355

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.

EPSS: 0.022 (80.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

Public proof-of-concept exploits

404notf0und/CVE-Flow

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-24355?: CVE-2020-24355 is a critical-severity vulnerability in Zyxel Vmg5313-B30b, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 9.8/10. Published 2020-09-02.
How severe is CVE-2020-24355?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-24355 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.