CVE-2024-12009: Zyxel Dx3300-t0 Firmware RCE Vulnerability

CVE-2024-12009 Overview

CVE-2024-12009 is a post-authentication command injection vulnerability affecting the ZyEE function across a wide range of Zyxel DSL, Ethernet CPE, fiber ONT, and WiFi extender devices. The flaw exists in the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier, along with related firmware branches shared across the affected product family. An authenticated attacker with administrator privileges can inject arbitrary operating system commands and execute them on the underlying device. The issue is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
An authenticated administrator can execute arbitrary OS commands on the router, leading to full device compromise, persistence on network edge infrastructure, and pivoting into internal networks.

Affected Products

Zyxel DSL CPE devices: DX3300-T0, DX3300-T1, DX3301-T0, DX4510-B0, DX4510-B1, DX5401-B0, DX5401-B1
Zyxel Ethernet CPE and fiber ONT devices: EE6510-10, EX3300-T0/T1, EX3301-T0, EX3500-T0, EX3501-T0, EX3510-B0/B1, EX3600-T0, EX5401-B0/B1, EX5501-B0, EX5510-B0, EX5512-T0, EX5601-T0/T1, EX7501-B0, EX7710-B0
Zyxel WiFi extenders, VMG, EMG, AX, PX, and WX series: EMG3525-T50B, EMG5523-T50B, EMG5723-T50K, VMG3625-T50B, VMG3927-T50K, VMG8623-T50B, VMG8825-T50K, AX7501-B0/B1, PX3321-T1, PX5301-T0, WX5600-T0, WX5610-B0

Discovery Timeline

2025-03-11 - Zyxel publishes security advisory for post-authentication command injection vulnerabilities in affected devices
2025-03-11 - CVE-2024-12009 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12009

Vulnerability Analysis

The vulnerability resides in the ZyEE function exposed by the device management interface. This function fails to properly neutralize special shell metacharacters in user-supplied parameters before passing them to an operating system command execution routine. An attacker who has authenticated to the device with administrator credentials can craft a request that concatenates arbitrary shell commands to the intended input. Successful exploitation results in command execution in the context of the device's management process, which typically runs with elevated privileges on embedded Linux platforms.

Because the affected devices are internet-facing gateways in most deployments, exploitation grants attackers a foothold on the network perimeter. Compromised routers can be leveraged for traffic interception, DNS manipulation, credential harvesting, and lateral movement into internal segments.

Root Cause

The root cause is improper input validation and sanitization within the ZyEE function. User-controlled parameters are incorporated into an OS command string without adequate escaping or use of parameterized execution APIs. This is a classic OS command injection pattern tracked under CWE-78.

Attack Vector

Exploitation requires network access to the device's management interface and valid administrator credentials. Once authenticated, the attacker issues a request to the vulnerable ZyEE handler containing shell metacharacters, command separators, or backtick constructs within a parameter that is later concatenated into a system command. No user interaction is required after authentication, and no PoC has been published at this time.

See the Zyxel Security Advisory for the vendor's technical description.

Detection Methods for CVE-2024-12009

Indicators of Compromise

Unexpected outbound connections originating from the router's management plane to unfamiliar IP addresses.
Configuration changes or new administrator sessions correlating with anomalous HTTP requests to the ZyEE endpoint.
Presence of shell metacharacters such as ;, |, &&, or backticks in device management request logs.

Detection Strategies

Inspect HTTP/HTTPS management requests for the ZyEE parameter carrying shell metacharacters or encoded command separators.
Correlate authenticated administrator sessions with process spawn events on the device (where syslog forwarding is enabled) to identify unexpected child processes.
Baseline normal administrative activity and alert on deviations, such as configuration changes outside maintenance windows.

Monitoring Recommendations

Forward router syslog and web management access logs to a centralized SIEM for retention and query.
Monitor for unauthorized administrator logins by IP, geolocation, and time-of-day anomalies.
Track firmware version inventory across the fleet to identify devices still running vulnerable builds.

How to Mitigate CVE-2024-12009

Immediate Actions Required

Apply the firmware update published in the Zyxel Security Advisory for each affected model.
Rotate all administrator credentials on affected devices, especially where default or reused passwords may be in place.
Audit administrative account inventories and remove unused or shared accounts.

Patch Information

Zyxel released patched firmware for the affected DSL, Ethernet CPE, fiber ONT, and WiFi extender devices on March 11, 2025. Administrators should consult the vendor advisory for the specific fixed firmware version corresponding to each model and apply updates through the standard device upgrade process. Devices running V5.70(ACDZ.3.6)C0 or earlier on the EX5601-T1, and equivalent branches on other listed models, are vulnerable and must be updated.

Workarounds

Restrict access to the device management interface to trusted management VLANs or specific administrative IP ranges.
Disable remote WAN-side administration where it is not operationally required.
Enforce strong, unique administrator passwords and, where supported, enable multi-factor authentication on the management interface.

bash

# Configuration example - restrict management interface to internal subnet
# Consult vendor documentation for exact CLI/GUI paths on each model
# 1. Disable WAN-side HTTP/HTTPS management
# 2. Restrict LAN-side management to a dedicated admin subnet, e.g. 10.10.0.0/24
# 3. Rotate the admin password and audit account list