CVE-2024-12398: Privilege Escalation in ZYXEL Access Point

📌 Note#

This is an excerpt from the official writeup sent to ZYXEL.

---

Summary#

During my audit on the WBE product series, I noticed that when a user with "limited-admin" privileges attempts to upload a custom configuration file, a popup is displayed, informing the user that the upload is prohibited due to insufficient privileges. However, this restriction can be bypassed under certain conditions, allowing unauthorized administrative access.

Limited-admin attempting to upload a custom config file#

Alert

This popup is managed by the script ZyFunction.js, located in /ext-js/common/, which checks the local variable isAdmin. If the variable is set to False, the warning message is displayed.

js
var dumpMsgIfLimitedAdmin = function() {
    if (!isAdmin) {
        Ext.MessageBox.show({
            msg: "This action is not allowed due to limited-admin privielege insufficent.",
            buttons: Ext.MessageBox.OK,
            icon: Ext.MessageBox.WARNING
        });
    }
    return !isAdmin;
}

However, by manipulating isAdmin variable, it is possible to attempt the upload, bypassing the client side check.

Alert

The CGI script in backend does not verify the identity of the requester, allowing a limited user to upload customized configuration files.

Alert

If the limited user attempts to upload the startup-config.conf, the device will reboot and load the provided configuration, thereby allowing the attacker to gain full control of the device.

---

Disclosure Timeline#

1. 2024-12-03ZYXEL was notified via <security@zyxel.com.tw>
2. 2024-12-04ZYXEL acknowledged my vulnerability report.
3. 2024-12-10ZYXEL assigned CVE-2024-12398 to the reported issues and informed me of their intention to publish their security advisory on 2025-01-14.
4. 2025-01-14ZYXEL published their security advisory, following our coordinated disclosure timeline.