CVE-2024-12398: Zyxel Firmware Privilege Escalation Issue

CVE-2024-12398 Overview

CVE-2024-12398 is an improper privilege management vulnerability [CWE-269] affecting the web management interface of multiple Zyxel access point (AP) and security router products. An authenticated user with limited privileges can escalate to administrator level and upload configuration files to the device. The flaw affects the WBE530 firmware through version 7.00(ACLE.3), the WBE660S firmware through 6.70(ACGG.2), and a broad range of NWA, WAC, WAX, and USG LITE product lines. Zyxel published an advisory on January 14, 2025 with fixed firmware versions.

Critical Impact
A low-privileged authenticated user can gain full administrative control of the affected Zyxel device and push arbitrary configuration files, enabling persistent compromise of wireless and routing infrastructure.

Affected Products

Zyxel WBE530 firmware through 7.00(ACLE.3) and WBE660S firmware through 6.70(ACGG.2)
Zyxel NWA series access points: NWA50AX, NWA50AX PRO, NWA55AXE, NWA90AX, NWA90AX PRO, NWA110AX, NWA130BE, NWA210AX, NWA220AX-6E, NWA1123ACv3
Zyxel WAC500, WAC500H, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, WAX655E and the USG LITE 60AX security router

Discovery Timeline

2025-01-14 - Zyxel publishes the security advisory covering CVE-2024-12398
2025-01-14 - CVE-2024-12398 published to the NVD
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12398

Vulnerability Analysis

The vulnerability is a privilege escalation flaw in the web management interface exposed by affected Zyxel APs and security routers. According to the vendor advisory, an authenticated user with limited privileges can elevate their session to administrator and upload configuration files to a vulnerable device. Uploading configuration files effectively rewrites the device policy, meaning attackers can change credentials, disable logging, alter routing and firewall rules, or plant persistent settings. The attack requires network reachability to the web management interface and a valid low-privilege account, but no user interaction.

Root Cause

The root cause is improper privilege management [CWE-269] in the web management interface. Authorization checks on privileged operations, including configuration file upload, do not correctly enforce the role of the requesting user. As a result, actions that should be restricted to administrators remain reachable by lower-privileged accounts.

Attack Vector

The attack vector is network-based against the device's web management interface. An attacker first authenticates as a limited user, either using legitimate credentials, credentials obtained through phishing, or credentials reused from another breach. They then invoke administrator-only functionality that the interface fails to gate, escalate to administrator context, and upload a crafted configuration file to take over the device.

No verified public proof-of-concept code is available. Refer to the Zyxel Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-12398

Indicators of Compromise

Unexpected configuration file uploads or configuration changes on affected Zyxel devices, especially from sessions belonging to non-admin accounts.
New or modified administrator accounts, altered firewall or VLAN policies, or newly enabled remote access services in device logs.
Web management interface access from unusual source IPs immediately followed by privileged operations by a limited-privilege user.

Detection Strategies

Forward Zyxel device syslog to a central SIEM and alert on privilege escalation events, configuration uploads, and administrator-level actions initiated by non-admin usernames.
Baseline expected administrators and configuration change windows, then flag out-of-band changes and uploads for review.
Correlate authentication events with subsequent configuration or firmware changes to identify sessions that transition from limited to administrative activity.

Monitoring Recommendations

Monitor HTTP/HTTPS traffic to the device management interface and restrict it to a dedicated management VLAN or jump host.
Track firmware and configuration file hashes on affected APs and routers, and alert on any change that does not map to an approved change ticket.
Review account inventories on Zyxel controllers and standalone APs to ensure only necessary limited-privilege accounts exist.

How to Mitigate CVE-2024-12398

Immediate Actions Required

Upgrade all affected Zyxel APs, WBE, WAC, WAX, NWA, and USG LITE 60AX devices to the fixed firmware versions listed in the vendor advisory.
Restrict access to the web management interface to trusted management networks and block it from the WAN and general user VLANs.
Audit local device accounts and remove or rotate credentials for any limited-privilege users that are no longer needed.

Patch Information

Zyxel released fixed firmware for the affected AP and security router product families in the advisory dated January 14, 2025. Refer to the Zyxel Security Advisory for the specific firmware build that corresponds to each model, including WBE530, WBE660S, the NWA series, the WAC and WAX series, and the USG LITE 60AX.

Workarounds

Limit management interface exposure using ACLs so only administrator workstations can reach the device web UI.
Enforce strong, unique passwords for every device account and disable any unused local accounts that could be leveraged for the initial authenticated foothold.
Enable multi-factor authentication where supported on the management plane and require VPN access before administrative sessions.

bash

# Configuration example: restrict web management access to a trusted subnet
Router> configure terminal
Router(config)# ip http server
Router(config)# access-list 10 permit 10.10.0.0 0.0.0.255
Router(config)# ip http access-class 10
Router(config)# end