rainpwn
    All writeups

    Privilege escalation  ZYXEL

    CVE-2024-12398: Privilege Escalation in ZYXEL Access Point

    I found a privilege escalation vulnerability in the WBE product series, allowing unauthorized administrative access under certain conditions.

    "Never attribute to malice that which is adequately explained by incompetence."
    – Hanlon's Razor

    📌 Note

    This is an excerpt from the official writeup sent to ZYXEL.

    Summary

    During my audit on the WBE product series, I noticed that when a user with "limited-admin" privileges attempts to upload a custom configuration file, a popup is displayed, informing the user that the upload is prohibited due to insufficient privileges. However, this restriction can be bypassed under certain conditions, allowing unauthorized administrative access.

    Limited-admin attempting to upload a custom config file

    Alert

    This popup is managed by the script ZyFunction.js, located in /ext-js/common/, which checks the local variable isAdmin. If the variable is set to False, the warning message is displayed.

    js
    var dumpMsgIfLimitedAdmin = function() {
    if (!isAdmin) {
        Ext.MessageBox.show({
            msg: "This action is not allowed due to limited-admin privielege insufficent.",
            buttons: Ext.MessageBox.OK,
            icon: Ext.MessageBox.WARNING
        });
    }
    return !isAdmin;
}

    However, by manipulating isAdmin variable, it is possible to attempt the upload, bypassing the client side check.

    Alert

    The CGI script in backend does not verify the identity of the requester, allowing a limited user to upload customized configuration files.

    Alert

    If the limited user attempts to upload the startup-config.conf, the device will reboot and load the provided configuration, thereby allowing the attacker to gain full control of the device.

    Disclosure Timeline

    1. 2024-12-03ZYXEL was notified via <security@zyxel.com.tw>
    2. 2024-12-04ZYXEL acknowledged my vulnerability report.
    3. 2024-12-10ZYXEL assigned CVE-2024-12398 to the reported issues and informed me of their intention to publish their security advisory on 2025-01-14.
    4. 2025-01-14ZYXEL published their security advisory, following our coordinated disclosure timeline.
    All writeups