CVE-2024-9677

CVE-2024-9677 is an insufficiently protected credentials vulnerability in the CLI command of Zyxel USG FLEX H series uOS firmware versions V1.21 and earlier. This allows an authenticated local attacker to achieve privilege escalation by stealing an administrator's authentication token, provided the administrator has not logged out. The vulnerability carries a CVSS score of 7.8 (High), indicating a low attack complexity and requiring local access, but leading to high confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.