{"id":"CVE-2024-22366","aliases":["EUVD-2024-19925","GHSA-ghrw-6hf4-xx3c"],"status":"published","title":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who...","description":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00321,"percentile":0.25254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-01-24T04:35:55Z","modified":"2026-06-17T07:11:15Z","products":[{"vendor":"yamaha","product":"wlx202_firmware"},{"vendor":"yamaha","product":"wlx212_firmware"},{"vendor":"yamaha","product":"wlx222_firmware"},{"vendor":"yamaha","product":"wlx313_firmware"},{"vendor":"yamaha","product":"wlx413_firmware"},{"vendor":"yamaha corporation","product":"wlx202"},{"vendor":"yamaha corporation","product":"wlx212"},{"vendor":"yamaha corporation","product":"wlx222"},{"vendor":"yamaha corporation","product":"wlx313"},{"vendor":"yamaha corporation","product":"wlx413"}],"references":[{"url":"http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU99896362.html","tags":["x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU99896362/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22366"},{"url":"https://jvn.jp/en/vu/JVNVU99896362"},{"url":"https://github.com/advisories/GHSA-ghrw-6hf4-xx3c"}],"sources":{"cve":[{"id":"CVE-2024-22366","description":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.","status":"published","published":"2024-01-24T04:35:55.337Z","modified":"2025-06-20T19:27:11.652Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19925","description":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.","status":"published","published":"2024-01-24T04:35:55Z","modified":"2025-06-20T19:27:11Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:18.601981Z"}],"ghsa":[{"id":"GHSA-ghrw-6hf4-xx3c","title":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who...","description":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.","status":"published","published":"2024-01-24T06:30:18Z","modified":"2025-06-20T21:31:52Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:46.844129Z"}],"nvd":[{"id":"CVE-2024-22366","description":"Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.","status":"published","published":"2024-01-24T05:15:13.823Z","modified":"2026-06-17T07:11:15.79Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:32.147098Z"}]}}