CVE-2024-7261

Name: CVE-2024-7261
Creator: NVD / NIST
Published: 2024-09-03T03:15:03.94+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 11.27%

Last modified Jun 17, 2026

CVE-2024-7261 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.. EPSS estimates a 11.27% chance of exploitation in the next 30 days.

Description

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

11.27%

95.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Zyxel	Nwa110ax Firmware	< 7.00\(abtg.2\)
Zyxel	Nwa1123-Ac Pro Firmware	< 6.28\(abhd.3\)
Zyxel	Nwa1123acv3 Firmware	< 6.70\(abvt.5\)
Zyxel	Nwa130be Firmware	< 7.00\(acil.2\)
Zyxel	Nwa210ax Firmware	< 7.00\(abtd.2\)
Zyxel	Nwa220ax-6e Firmware	< 7.00\(acco.2\)
Zyxel	Nwa50ax Firmware	< 7.00\(abyw.2\)
Zyxel	Nwa50ax Pro Firmware	< 7.00\(acge.2\)
Zyxel	Nwa55axe Firmware	< 7.00\(abzl.2\)
Zyxel	Nwa90ax Firmware	< 7.00\(accv.2\)
Zyxel	Nwa90ax Pro Firmware	< 7.00\(acgf.2\)
Zyxel	Usg Lite 60ax Firmware	< v2.00\(acip.3\)
Zyxel	Wac500 Firmware	< 6.70\(abvs.5\)
Zyxel	Wac500h Firmware	< 6.70\(abwa.5\)
Zyxel	Wac6103d-I Firmware	< 6.28\(aaxh.3\)
Zyxel	Wac6502d-S Firmware	< 6.28\(aase.3\)
Zyxel	Wac6503d-S Firmware	< 6.28\(aasf.3\)
Zyxel	Wac6552d-S Firmware	< 6.28\(abio.3\)
Zyxel	Wac6553d-E Firmware	< 6.28\(aasg.3\)
Zyxel	Wax300h Firmware	< 7.00\(achf.2\)
Zyxel	Wax510d Firmware	< 7.00\(abtf.2\)
Zyxel	Wax610d Firmware	< 7.00\(abte.2\)
Zyxel	Wax620d-6e Firmware	< 7.00\(accn.2\)
Zyxel	Wax630s Firmware	< 7.00\(abzd.2\)
Zyxel	Wax640s-6e Firmware	< 7.00\(accm.2\)
Zyxel	Wax650s Firmware	< 7.00\(abrm.2\)
Zyxel	Wax655e Firmware	< 7.00\(acdo.2\)
Zyxel	Wbe530 Firmware	< 7.00\(acle.2\)
Zyxel	Wbe660s Firmware	< 7.00\(acgg.2\)

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-aps-and-security-router-devices-09-03-2024Vendor Advisory

Timeline

Published: Sep 3, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-7261?

How severe is CVE-2024-7261?

CVE-2024-7261 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 11.27% probability of exploitation in the next 30 days.

How do I fix CVE-2024-7261?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-7261?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST