Threat actors could leverage CVE-2024-20439 via static credentials to facilitate the compromise of targeted systems with administrative privileges while intrusions involving CVE-2024-20440 could enable the acquisition of log files with credentials and other sensitive details.
Multiple Zyxel NWA Series, NWA1123-AC PRO, NWA1123ACv3, WAC500, WAC500H, WAC Series, WAX Series, and WBE Series access points are impacted by the flaw, which stems from improper user-supplied data management.
Such a flaw, tracked as CVE-2024-4885, stems from improper user input validation of the GetFileWithoutZip method adopted by WhatsUp Gold, noted Summoning Team, which identified and disclosed the issue.
Attacks by the first threat actor involved abuse of the flaw to deploy the XMRig miner while the second threat actor leveraged a shell script to facilitate miner delivery across a targeted environment's accessible endpoints.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
