CVE-2024-7261

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

• zyxel nwa110ax firmware (< 7.00\(abtg.2\)) • zyxel nwa1123-ac pro firmware (< 6.28\(abhd.3\)) • zyxel nwa1123acv3 firmware (< 6.70\(abvt.5\)) • zyxel nwa130be firmware (< 7.00\(acil.2\)) • zyxel nwa210ax firmware (< 7.00\(abtd.2\)) • zyxel nwa220ax-6e firmware (< 7.00\(acco.2\)) • zyxel nwa50ax firmware (< 7.00\(abyw.2\)) • zyxel nwa50ax pro firmware (< 7.00\(acge.2\)) • zyxel nwa55axe firmware (< 7.00\(abzl.2\)) • zyxel nwa90ax firmware (< 7.00\(accv.2\)) • zyxel nwa90ax pro firmware (< 7.00\(acgf.2\)) • zyxel usg lite 60ax firmware (< v2.00\(acip.3\)) • zyxel wac500 firmware (< 6.70\(abvs.5\)) • zyxel wac500h firmware (< 6.70\(abwa.5\)) • zyxel wac6103d-i firmware (< 6.28\(aaxh.3\)) • zyxel wac6502d-s firmware (< 6.28\(aase.3\)) • zyxel wac6503d-s firmware (< 6.28\(aasf.3\)) • zyxel wac6552d-s firmware (< 6.28\(abio.3\)) • zyxel wac6553d-e firmware (< 6.28\(aasg.3\)) • zyxel wax300h firmware (< 7.00\(achf.2\)) • zyxel wax510d firmware (< 7.00\(abtf.2\)) • zyxel wax610d firmware (< 7.00\(abte.2\)) • zyxel wax620d-6e firmware (< 7.00\(accn.2\)) • zyxel wax630s firmware (< 7.00\(abzd.2\)) • zyxel wax640s-6e firmware (< 7.00\(accm.2\)) • zyxel wax650s firmware (< 7.00\(abrm.2\)) • zyxel wax655e firmware (< 7.00\(acdo.2\)) • zyxel wbe530 firmware (< 7.00\(acle.2\)) • zyxel wbe660s firmware (< 7.00\(acgg.2\))