CVE-2024-41720 - Vulnerability Details - OpenCVE

Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Zexelon	Zwx-2000csw2-hn Zwx-2000csw2-hn Firmware

Configuration 1 [-]

AND

cpe:2.3:o:zexelon:zwx-2000csw2-hn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zexelon:zwx-2000csw2-hn:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN70666401/
https://www.zexelon.co.jp/pdf/jvn70666401.pdf

History

Fri, 30 Aug 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zexelon Zexelon zwx-2000csw2-hn Zexelon zwx-2000csw2-hn Firmware
Weaknesses		CWE-732
CPEs		cpe:2.3:h:zexelon:zwx-2000csw2-hn:::::::: cpe:2.3:o:zexelon:zwx-2000csw2-hn_firmware::::::::
Vendors & Products		Zexelon Zexelon zwx-2000csw2-hn Zexelon zwx-2000csw2-hn Firmware
Metrics		cvssV3_1 `{'score': 8.0, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-08-05T04:36:17.042Z

Updated: 2025-03-17T15:02:35.181Z

Reserved: 2024-07-26T05:46:46.795Z

Link: CVE-2024-41720

Vulnrichment

Updated: 2024-08-05T18:45:46.012Z

NVD

Status : Modified

Published: 2024-08-05T05:15:39.637

Modified: 2025-03-17T15:15:41.073

Link: CVE-2024-41720

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zexelon:zwx-2000csw2-hn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9F38FB9-D0CB-48E9-B09A-DF962CA0B0B6", "versionEndExcluding": "0.3.15", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zexelon:zwx-2000csw2-hn:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2349E09-CC89-41F6-AA4A-14B96D10EED8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device."}, {"lang": "es", "value": "Existe una asignaci\u00f3n de permisos incorrecta para problemas de recursos cr\u00edticos en versiones de firmware ZWX-2000CSW2-HN anteriores a la versi\u00f3n 0.3.15, lo que puede permitir que un atacante autenticado adyacente a la red altere la configuraci\u00f3n del dispositivo."}], "id": "CVE-2024-41720", "lastModified": "2025-03-17T15:15:41.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-05T05:15:39.637", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN70666401/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.zexelon.co.jp/pdf/jvn70666401.pdf"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}