CVE-2024-7203

CVSS 3.1: 7.2 high
EPSS: 1%p70
Published: Sep 3, 2024 · Sep 3, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-7203 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device by executing a crafted CLI command.

Vendors: zyxel

Products: zld

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news

3 stories

Zyxel Patches Critical OS Command Injection Flaw in Access Points and Routers

The Hacker NewsSep 4, 23:02 UTC · Sep 4, 2024VulnerabilityCVE-2024-7261 CVE-2024-5412 CVE-2024-6343+72 · 1 read

Critical flaw in Zyxel's secure routers allows OS command execution via cookie (CVE-2024-7261)

Help Net SecuritySep 3, 00:00 UTC · Sep 3, 2024VulnerabilityCVE-2024-7261 CVE-2024-6343 CVE-2024-7203+62 · 1 read

Zyxel warns of vulnerabilities in a wide range of its products

Ars Technica · SecuritySep 4, 18:57 UTC · Sep 4, 2024VulnerabilityCVE-2024-7261 CVE-2024-6343 CVE-2024-7203+13 · 1 read