CVE-2024-7261

Katalog CVE

CVSS 9.8 · Critical EPSS 11,4%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada zyxel nwa110ax firmware, zyxel nwa1123-ac pro firmware +27 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut zyxel.com.tw.

Deskripsi (NVD)

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Rincian

Terbit di NVD

3 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber zyxel.com.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

11,4% peluang dieksploitasi; lebih tinggi dari 95,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-v... advisory vendor