CVE-2024-7261

—

CVSS 3.1

9.8 critical

EPSS

11%p96

Published

Sep 3, 2024 (Sep 3, 2024)

Modified

Jun 17, 2026

Description

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Vendors: zyxel
Products: nwa110ax firmware, nwa1123-ac pro firmware, nwa1123acv3 firmware, nwa130be firmware, nwa210ax firmware, nwa220ax-6e firmware, nwa50ax firmware, nwa50ax pro firmware, nwa55axe firmware, nwa90ax firmware, nwa90ax pro firmware, usg lite 60ax firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (11.4%)

In the news5 stories

Week in review: Vulnerability allows Yubico security keys cloning, Patch Tuesday forecast

Help Net SecuritySep 8, 00:00 UTC · Sep 8, 2024Vulnerability CVE-2024-7261 CVE-2024-45195

Zyxel Patches Critical OS Command Injection Flaw in Access Points and Routers

The Hacker NewsSep 4, 23:02 UTC · Sep 4, 2024Vulnerability CVE-2024-7261 CVE-2024-5412 CVE-2024-6343+7 CVEs

Zyxel fixed critical OS command injection flaw in multiple routers

Security AffairsSep 4, 06:27 UTC · Sep 4, 2024Vulnerability CVE-2024-7261 CVE-2017-18368

Critical flaw in Zyxel's secure routers allows OS command execution via cookie (CVE-2024-7261)

Help Net SecuritySep 3, 00:00 UTC · Sep 3, 2024Vulnerability CVE-2024-7261 CVE-2024-6343 CVE-2024-7203+6 CVEs

Zyxel warns of vulnerabilities in a wide range of its products

Ars Technica · SecuritySep 4, 18:57 UTC · Sep 4, 2024Vulnerability CVE-2024-7261 CVE-2024-6343 CVE-2024-7203+1 CVEs