cve/2024/CVE-2024-9677.md

CVE-2024-9677

Description

The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier versions could allow an authenticated local attacker to gain privilege escalation by stealing the authentication token of a login administrator. Note that this attack could be successful only if the administrator has not logged out.

POC

Reference

No PoCs from references.

Github

• https://github.com/rainpwn/exploits