How severe is CVE-2024-42057?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.1 out of 10.

What type of vulnerability is CVE-2024-42057?

This is classified as CWE-78, which is a common weakness in software security.

CVE-2024-42057 - HIGH Severity | CVSS 8.1

Vulnerability Description

A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device. Note that this attack could be successful only if the device was configured in User-Based-PSK authentication mode and a valid user with a long username exceeding 28 characters exists.

Related Vulnerabilities

CVE-2015-7611

HIGH

CVSS:8.1(High)

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

CWE-782015

CVE-2016-1482

HIGH

CVSS:8.1(High)

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.

CWE-782016

CVE-2017-11318

HIGH

CVSS:8.1(High)

Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can execute system commands remotely by abus...

CWE-782017

CVE-2017-12581

HIGH

CVSS:8.1(High)

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earl...

CWE-782017

CVE-2017-14705

HIGH

CVSS:8.1(High)

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webserv...

CWE-782017

CVE-2017-2824

HIGH

CVSS:8.1(High)

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote cod...

CWE-782017