What is CVE-2024-7261?

CVE-2024-7261 is a critical-severity vulnerability in Zyxel Nwa110ax, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-09-03.

How severe is CVE-2024-7261?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2024-7261 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Zyxel Nwa110ax

CVE-2024-7261

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(AC…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.114 (95.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zyxel Nwa110ax
Zyxel Nwa110ax_firmware
Zyxel Nwa1123-ac_pro
Zyxel Nwa1123-ac_pro_firmware
Zyxel Nwa1123acv3
Zyxel Nwa1123acv3 Firmware — versions <= 6.70(ABVT.4)
Zyxel Nwa1123acv3_firmware
Zyxel Nwa130be
Zyxel Nwa130be_firmware
Zyxel Nwa210ax

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

security@zyxel.com.tw (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2024-7261?: CVE-2024-7261 is a critical-severity vulnerability in Zyxel Nwa110ax, classified under OS Command Injection. CVSS score: 9.8/10. Published 2024-09-03.
How severe is CVE-2024-7261?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2024-7261 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.