CVE-2024-12010: Zyxel WX5610-B0 Firmware RCE Vulnerability

CVE-2024-12010 Overview

CVE-2024-12010 is a post-authentication command injection vulnerability affecting the zyUtilMailSend function in multiple Zyxel DSL, Ethernet CPE, Fiber ONT, and WiFi extender devices. The flaw allows an authenticated attacker holding administrator credentials to execute arbitrary operating system commands on the underlying device. The vulnerability is classified under CWE-78, OS Command Injection. Zyxel disclosed the issue in a coordinated security advisory covering more than 30 product families, including the AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier.

Critical Impact
An administrator-level attacker can execute arbitrary OS commands on affected Zyxel gateways, gaining full control of the device and a persistent foothold in the network perimeter.

Affected Products

Zyxel AX7501-B0 and AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier
Zyxel DX, EX, EE, EMG, VMG, WX, and PX series CPE, Fiber ONT, and WiFi extender devices
Zyxel WX5610-B0, WX5600-T0, and related WiFi extender firmware

Discovery Timeline

2025-03-11 - Zyxel publishes coordinated security advisory covering the zyUtilMailSend command injection
2025-03-11 - CVE-2024-12010 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12010

Vulnerability Analysis

The vulnerability resides in the zyUtilMailSend utility function used by the device's management plane to send diagnostic or notification emails. The function fails to sanitize input passed to shell-invoking routines. An authenticated administrator can inject shell metacharacters into a parameter that ultimately reaches an OS command interpreter, allowing arbitrary command execution in the device context.

Exploitation requires valid administrator credentials, which limits opportunistic attacks. However, Zyxel edge devices are frequently exposed to the internet through management interfaces. Attackers who obtain credentials through phishing, credential stuffing, reused passwords, or prior compromise can escalate from web-UI access to full command execution on the router. Because these devices sit at the network edge, successful exploitation provides a pivot point for lateral movement, DNS manipulation, traffic interception, and persistence outside traditional endpoint visibility.

Root Cause

The root cause is missing input validation and unsafe construction of a shell command string inside the zyUtilMailSend function. User-controlled fields associated with the mail-sending feature are concatenated into a command line without escaping or allow-list filtering. This is a classic OS command injection pattern documented under CWE-78.

Attack Vector

The attack vector is network-based against the device's administrative interface. An authenticated administrator submits a crafted request that reaches the vulnerable zyUtilMailSend code path. Injected shell metacharacters, such as backticks, semicolons, or command substitution, are executed by the underlying shell with the privileges of the calling process. No verified public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-12010

Indicators of Compromise

Unexpected administrator logins to the Zyxel management interface from unfamiliar IPs or geographies
Outbound connections from the Zyxel device to unknown hosts, particularly on non-standard ports
Modifications to device configuration, DNS settings, firewall rules, or user accounts that were not initiated by administrators
Unusual SMTP or mail-notification activity originating from the device

Detection Strategies

Monitor administrative HTTP/HTTPS requests to the Zyxel web UI for suspicious parameters containing shell metacharacters such as ;, |, `, $(, and &&
Baseline expected outbound traffic from network appliances and alert on deviations, especially new destinations or reverse-shell-like connection patterns
Correlate administrator authentication events with subsequent configuration changes to detect credential misuse

Monitoring Recommendations

Forward Zyxel syslog and authentication logs to a centralized log platform for long-term retention and correlation
Alert on any new persistent processes, cron entries, or firmware/config downloads on the device
Track firmware versions across the fleet and flag devices still running vulnerable builds such as V5.17(ABPC.5.3)C0 or earlier

How to Mitigate CVE-2024-12010

Immediate Actions Required

Apply the firmware updates published in the Zyxel Security Advisory for each affected model
Rotate all administrator credentials on affected devices and enforce strong, unique passwords
Restrict access to the device management interface to trusted internal networks or a jump host, and disable WAN-side administration

Patch Information

Zyxel released fixed firmware for the affected DSL, Ethernet CPE, Fiber ONT, and WiFi extender product lines. Refer to the Zyxel Security Advisory on Command Injection for the exact fixed version corresponding to each model. Devices running V5.17(ABPC.5.3)C0 or earlier on the AX7501-B1 platform, and equivalent vulnerable builds on other affected models, must be upgraded.

Workarounds

Disable remote (WAN) management on the device until firmware can be applied
Place affected devices behind an access-control list that only permits administrative connections from designated management IPs
Enable multi-factor authentication for administrative access where the device supports it, and audit existing administrator accounts to remove unused entries

bash

# Example: restrict inbound management access at an upstream firewall
# (adapt IPs and interfaces to your environment)
iptables -A INPUT -i wan0 -p tcp --dport 443 -s 203.0.113.10 -j ACCEPT
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 80  -j DROP