CVE-2024-7261 Command injection in NWA1123ACv3 firmware

Critical 9.8 Published 3 Sep 2024 Updated 5 Sep 2024

Unauthenticated attackers can execute OS commands on Zyxel network devices via crafted cookies in the CGI program.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-7261?

CVE-2024-7261 is a critical command injection vulnerability in Zyxel NWA1123ACv3 firmware, published on 3 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4)

and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1)

and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Weakness: CWE-78

Which versions are affected by CVE-2024-7261?

It affects 29 products.

Products include Zyxel Nwa110ax Firmware, Zyxel Nwa1123-Ac Pro Firmware, Zyxel Nwa1123acv3 Firmware, Zyxel Nwa130be Firmware, Zyxel Nwa210ax Firmware, Zyxel Nwa220ax-6e Firmware and 23 more.

How do I fix CVE-2024-7261?

No fix has been published for CVE-2024-7261 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-7261 being exploited?

There is no known exploitation of CVE-2024-7261 in the wild and no public exploit code.

Sources

Also known as GHSA-4c9r-w43c-8v76.