CVE-2024-9200

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
ZyxelVMG4005-B50A firmware<= V5.15(ABQA.2.2)C0
zyxelemg6726-b10a_firmware<= 5.13\(abnp.8\)c0
zyxelvmg3927-b50b_firmware<= 5.13\(ably.9\)c0
zyxelvmg4005-b50a_firmware<= 5.15\(abqa.2.2\)c0
zyxelvmg4005-b60a_firmware<= 5.15\(abqa.2.2\)c0
zyxelvmg4005-b50b_firmware<= 5.13\(abrl.5.1\)c0
zyxelvmg4927-b50a_firmware<= 5.13\(ably.9\)c0

References

Timeline

Published
Dec 3, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-92019.8The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of tCVE-2024-92025.3In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can seCVE-2024-92032.5A vulnerability, which was classified as problematic, has been found in Enpass Password Manager up to 6.9.5 on Windows. This issue affects sCVE-2024-92046.1The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versCVE-2024-92056.1The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_queCVE-2024-92066.1The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg wiCVE-2024-92076.1The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriCVE-2024-92086.1The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_queryCVE-2024-92096.1The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without approprCVE-2024-92106.1The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without apCVE-2024-92116.1The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg wCVE-2024-92126.1The SKU Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg witho
CVE-2024-9200: High severity, CVSS 7.2 | Vulnix