CVE-2020-24355

9.8 criticalEPSS 2.2%

Critical (9.8) in zyxel vmg5313-b30b firmware. EPSS 2.2% chance of exploitation in the next 30 days.

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during account creation. Similar may also be possible with account deletion.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2020-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zyxel:vmg5313-b30b_firmware

References

https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2
https://www.zyxel.com/support/security_advisories.shtml
https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B
https://blog.somegeneric.ninja/Zyxel_VMG5153_B30B_part2

Check your stack JSON