by Kastro CVE-2024-7261
Zyxel NWA1123ACv3 firmware — The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABV…
Description · from the CVE record
The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.
Affected
ProductAffectedFixed inSource
NWA1123ACv3 firmware<= 6.70(ABVT.4)–CNA
WAC500 firmware<= 6.70(ABVS.4)–CNA
WAX655E firmware<= 7.00(ACDO.1)–CNA
WBE530 firmware<= 7.00(ACLE.1)–CNA
USG LITE 60AX firmwareV2.00(ACIP.2)–CNA
usg_lite_60ax_firmware≤ V2.00\(ACIP.2\)–CISA-ADP
nwa1123acv3_firmware≤ 6.70\(ABVT.4\)–CISA-ADP
wac500_firmware≤ 6.70\(ABVS.4\)–CISA-ADP
wax655e_firmware≤ 7.00\(ACDO.1\)–CISA-ADP
wbe530_firmware≤ 7.00\(ACLE.1\)–CISA-ADP
Scores by source
Zyxel (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total