CVE-2024-5412 Overview
CVE-2024-5412 is a buffer overflow vulnerability [CWE-120] in the libclinkc library shipped with a wide range of Zyxel customer-premises equipment (CPE), including 5G NR CPE, DSL/Ethernet CPE, fiber ONT, Wi-Fi extenders, and security routers. An unauthenticated remote attacker can trigger denial of service (DoS) by sending a crafted HTTP request to a vulnerable device. The flaw was disclosed by Zyxel on September 3, 2024 and affects firmware across the VMG, EX, DX, EMG, NR, PX, PM, AX, WX, SCR, and Nebula FWA/LTE product lines.
Critical Impact
Network-reachable attackers can crash affected Zyxel CPE without authentication, disrupting internet connectivity for residential and enterprise users.
Affected Products
- Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 (reference product)
- Zyxel DSL/Ethernet CPE: VMG, EX, DX, EMG, PX series
- Zyxel 5G NR / LTE CPE and Nebula FWA series: NR5103, NR7101, FWA505, FWA710, LTE3301-Plus
Discovery Timeline
- 2024-09-03 - Zyxel publishes security advisory for the buffer overflow
- 2024-09-03 - CVE-2024-5412 published to NVD
- 2026-02-24 - Last updated in NVD database
Technical Details for CVE-2024-5412
Vulnerability Analysis
The defect resides in libclinkc, a shared library used by Zyxel CPE firmware to parse and dispatch HTTP requests handled by the device web management stack. A function in the library copies attacker-controlled HTTP request data into a fixed-size buffer without enforcing length checks. When the supplied input exceeds the destination buffer, adjacent stack or heap memory is corrupted.
On the affected Zyxel devices the corruption leads to a process crash and watchdog reboot rather than code execution, which is consistent with the impact metrics published by the vendor. Repeated requests can keep the device in a reboot loop, effectively removing it from service. Because libclinkc is linked into the HTTP service exposed by most Zyxel CPE images, the same root cause spans the broad device list in the Zyxel advisory.
Root Cause
The root cause is classic unbounded buffer copy behavior [CWE-120] inside libclinkc. Parsing logic trusts attacker-supplied HTTP fields and writes them into a stack or static buffer without validating the size. No authentication is required to reach the vulnerable parser, and no user interaction is needed.
Attack Vector
Exploitation requires network access to the device web interface over HTTP/HTTPS. An attacker sends a single crafted HTTP request with an oversized field that traverses the vulnerable libclinkc parsing path. The target service overruns its buffer and terminates, causing the device to lose management and routing functionality until it recovers. No public proof-of-concept or exploit code is listed for CVE-2024-5412, and the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.
// No verified proof-of-concept is publicly available for CVE-2024-5412.
// See the Zyxel security advisory for vendor-confirmed technical details.
Detection Methods for CVE-2024-5412
Indicators of Compromise
- Unexpected reboots or watchdog-triggered restarts of Zyxel CPE devices following inbound HTTP traffic.
- Crash entries or segmentation faults in device system logs referencing the HTTP daemon or libclinkc.
- Loss of WAN or LAN connectivity correlated with bursts of HTTP requests to the device management interface.
Detection Strategies
- Monitor inbound HTTP/HTTPS requests to Zyxel CPE management interfaces for abnormally long header values, URIs, or POST bodies.
- Alert on repeated TCP resets or connection terminations on ports 80/443 of CPE devices, which often follow a crash.
- Correlate device availability monitoring (ICMP, SNMP) with HTTP request spikes to identify reboot loops caused by exploitation attempts.
Monitoring Recommendations
- Forward device syslog from Zyxel CPE to a central log platform and create rules for HTTP service crashes and unscheduled reboots.
- Track firmware versions across the fleet and flag devices still running pre-patch builds of the affected models.
- Baseline normal management-plane traffic so that scanning or fuzzing against the web UI stands out quickly.
How to Mitigate CVE-2024-5412
Immediate Actions Required
- Apply the firmware updates published in the Zyxel Security Advisory for Buffer Overflow for every affected model in the environment.
- Restrict access to the device web management interface so that it is not reachable from the internet or untrusted networks.
- Inventory Zyxel CPE across remote offices and residential deployments and prioritize internet-exposed devices for patching.
Patch Information
Zyxel released fixed firmware for the affected 5G NR CPE, DSL/Ethernet CPE, fiber ONT, Wi-Fi extender, and security router devices on September 3, 2024. Refer to the Zyxel Security Advisory for Buffer Overflow for the specific firmware version per model, including the VMG8825-T50K firmware that supersedes 5.50(ABOM.8)C0.
Workarounds
- Disable remote management (WAN-side HTTP/HTTPS access) on all affected Zyxel CPE devices until patching is complete.
- Place an upstream firewall or ACL in front of management ports 80 and 443 to allow access only from administrative IP ranges.
- For ISP-managed deployments, push configuration changes via TR-069/ACS to confirm management UI exposure is closed by default.
# Example ACL concept: restrict management access to a trusted subnet
# (apply equivalent rules on the upstream router or device firewall)
# Allow management only from 10.10.0.0/24
# Deny all other inbound HTTP/HTTPS to the CPE management IP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
