Strix
26.1K

CVE-2024-7261

CRITICALCVSS 9.8/10EPSS 11.27%

Last modified

CVE-2024-7261 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.. EPSS estimates a 11.27% chance of exploitation in the next 30 days.

Description

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
11.27%

95.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ZyxelNwa110ax Firmware< 7.00\(abtg.2\)
ZyxelNwa1123-Ac Pro Firmware< 6.28\(abhd.3\)
ZyxelNwa1123acv3 Firmware< 6.70\(abvt.5\)
ZyxelNwa130be Firmware< 7.00\(acil.2\)
ZyxelNwa210ax Firmware< 7.00\(abtd.2\)
ZyxelNwa220ax-6e Firmware< 7.00\(acco.2\)
ZyxelNwa50ax Firmware< 7.00\(abyw.2\)
ZyxelNwa50ax Pro Firmware< 7.00\(acge.2\)
ZyxelNwa55axe Firmware< 7.00\(abzl.2\)
ZyxelNwa90ax Firmware< 7.00\(accv.2\)
ZyxelNwa90ax Pro Firmware< 7.00\(acgf.2\)
ZyxelUsg Lite 60ax Firmware< v2.00\(acip.3\)
ZyxelWac500 Firmware< 6.70\(abvs.5\)
ZyxelWac500h Firmware< 6.70\(abwa.5\)
ZyxelWac6103d-I Firmware< 6.28\(aaxh.3\)
ZyxelWac6502d-S Firmware< 6.28\(aase.3\)
ZyxelWac6503d-S Firmware< 6.28\(aasf.3\)
ZyxelWac6552d-S Firmware< 6.28\(abio.3\)
ZyxelWac6553d-E Firmware< 6.28\(aasg.3\)
ZyxelWax300h Firmware< 7.00\(achf.2\)
ZyxelWax510d Firmware< 7.00\(abtf.2\)
ZyxelWax610d Firmware< 7.00\(abte.2\)
ZyxelWax620d-6e Firmware< 7.00\(accn.2\)
ZyxelWax630s Firmware< 7.00\(abzd.2\)
ZyxelWax640s-6e Firmware< 7.00\(accm.2\)
ZyxelWax650s Firmware< 7.00\(abrm.2\)
ZyxelWax655e Firmware< 7.00\(acdo.2\)
ZyxelWbe530 Firmware< 7.00\(acle.2\)
ZyxelWbe660s Firmware< 7.00\(acgg.2\)

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2024-7261?
The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.
How severe is CVE-2024-7261?
CVE-2024-7261 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 11.27% probability of exploitation in the next 30 days.
How do I fix CVE-2024-7261?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2024

View all 2024CVEs →

Are you affected by CVE-2024-7261?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST