CVE-2024-7261: OS Command Injection
The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4)
and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1)
and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7261?
CVE-2024-7261 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-7261?
To fix CVE-2024-7261, update the affected Zyxel firmware to the latest version that addresses this vulnerability.
Which devices are affected by CVE-2024-7261?
CVE-2024-7261 affects multiple Zyxel devices including NWA1123ACv3, WAC500, WAX655E, and several others running specified firmware versions.
What types of vulnerabilities does CVE-2024-7261 involve?
CVE-2024-7261 involves improper neutralization of special elements in the "host" parameter, leading to OS command injection.
When was CVE-2024-7261 discovered?
CVE-2024-7261 was publicly disclosed in March 2024, revealing critical security flaws in various Zyxel networking devices.