CVE-2024-41720

Vulnerability

Incorrect permission assignment for critical resource (CWE-732) exists in ZEXELON ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15. The device is a high-speed coaxial modem with wireless LAN functions. The vulnerability allows a network-adjacent authenticated attacker to alter the configuration of the device [1].

Exploitation

An attacker must be network-adjacent and have valid authentication credentials (low privilege required). No user interaction is needed. The attack complexity is low. The attacker can exploit the incorrect permission assignment to modify device configuration [1].

Impact

Successful exploitation allows the attacker to alter the configuration of the device, potentially leading to compromise of confidentiality, integrity, and availability (CVSS 8.0, High). The impact is high across all CIA triad [1].

Mitigation

Update the firmware to the latest version (Ver.0.3.15 or later) as per the developer's instructions [1]. No workarounds are mentioned. The vulnerability is not listed on CISA KEV as of publication.