Skip to content
Fencer Vulns
critical 9.8

CVE-2024-7261 in the critical feed json

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.…

published 2024-09-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-48208

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.4%
EPSS 11.4% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4)

and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1)

and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Patch / fix

  • zyxel nwa110ax_firmware 7.00\(abtg.2\)
  • zyxel nwa1123-ac_pro_firmware 6.28\(abhd.3\)
  • zyxel nwa1123acv3_firmware 6.70\(abvt.5\)
  • zyxel nwa130be_firmware 7.00\(acil.2\)
  • zyxel nwa210ax_firmware 7.00\(abtd.2\)
  • zyxel nwa220ax-6e_firmware 7.00\(acco.2\)
  • zyxel nwa50ax_firmware 7.00\(abyw.2\)
  • zyxel nwa50ax_pro_firmware 7.00\(acge.2\)
  • zyxel nwa55axe_firmware 7.00\(abzl.2\)
  • zyxel nwa90ax_firmware 7.00\(accv.2\)
  • zyxel nwa90ax_pro_firmware 7.00\(acgf.2\)
  • zyxel usg_lite_60ax_firmware v2.00\(acip.3\)
  • zyxel wac500_firmware 6.70\(abvs.5\)
  • zyxel wac500h_firmware 6.70\(abwa.5\)
  • zyxel wac6103d-i_firmware 6.28\(aaxh.3\)
  • zyxel wac6502d-s_firmware 6.28\(aase.3\)
  • zyxel wac6503d-s_firmware 6.28\(aasf.3\)
  • zyxel wac6552d-s_firmware 6.28\(abio.3\)
  • zyxel wac6553d-e_firmware 6.28\(aasg.3\)
  • zyxel wax300h_firmware 7.00\(achf.2\)

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

11.41% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Zyxel NWA1123ACv3 firmware
  • Zyxel WAC500 firmware
  • Zyxel WAX655E firmware
  • Zyxel WBE530 firmware
  • Zyxel USG LITE 60AX firmware
  • zyxel usg_lite_60ax_firmware
  • zyxel nwa1123acv3_firmware
  • zyxel wac500_firmware
  • zyxel wax655e_firmware
  • zyxel wbe530_firmware

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.