CVE-2024-7261: Zyxel NWA110AX Firmware

Critical severity, CVSS 9.8. EPSS: 11.4% chance of exploitation in the next 30 days.

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Affected products

• Zyxel NWA110AX Firmware: before 7.00\(abtg.2\) (fixed in 7.00\(abtg.2\))
• Zyxel NWA1123-Ac Pro Firmware: before 6.28\(abhd.3\) (fixed in 6.28\(abhd.3\))
• Zyxel NWA1123ACV3 Firmware: before 6.70\(abvt.5\) (fixed in 6.70\(abvt.5\))
• Zyxel NWA130BE Firmware: before 7.00\(acil.2\) (fixed in 7.00\(acil.2\))
• Zyxel NWA210AX Firmware: before 7.00\(abtd.2\) (fixed in 7.00\(abtd.2\))
• Zyxel NWA220AX-6e Firmware: before 7.00\(acco.2\) (fixed in 7.00\(acco.2\))
• Zyxel NWA50AX Firmware: before 7.00\(abyw.2\) (fixed in 7.00\(abyw.2\))
• Zyxel NWA50AX Pro Firmware: before 7.00\(acge.2\) (fixed in 7.00\(acge.2\))
• Zyxel NWA55AXE Firmware: before 7.00\(abzl.2\) (fixed in 7.00\(abzl.2\))
• Zyxel NWA90AX Firmware: before 7.00\(accv.2\) (fixed in 7.00\(accv.2\))
• Zyxel NWA90AX Pro Firmware: before 7.00\(acgf.2\) (fixed in 7.00\(acgf.2\))
• Zyxel Usg Lite 60ax Firmware: before v2.00\(acip.3\) (fixed in v2.00\(acip.3\))
• Zyxel WAC500 Firmware: before 6.70\(abvs.5\) (fixed in 6.70\(abvs.5\))
• Zyxel WAC500H Firmware: before 6.70\(abwa.5\) (fixed in 6.70\(abwa.5\))
• Zyxel WAC6103D-I Firmware: before 6.28\(aaxh.3\) (fixed in 6.28\(aaxh.3\))
• Zyxel WAC6502D-S Firmware: before 6.28\(aase.3\) (fixed in 6.28\(aase.3\))
• Zyxel WAC6503D-S Firmware: before 6.28\(aasf.3\) (fixed in 6.28\(aasf.3\))
• Zyxel WAC6552D-S Firmware: before 6.28\(abio.3\) (fixed in 6.28\(abio.3\))
• Zyxel WAC6553D-E Firmware: before 6.28\(aasg.3\) (fixed in 6.28\(aasg.3\))
• Zyxel WAX300H Firmware: before 7.00\(achf.2\) (fixed in 7.00\(achf.2\))
• Zyxel WAX510D Firmware: before 7.00\(abtf.2\) (fixed in 7.00\(abtf.2\))
• Zyxel WAX610D Firmware: before 7.00\(abte.2\) (fixed in 7.00\(abte.2\))
• Zyxel WAX620D-6e Firmware: before 7.00\(accn.2\) (fixed in 7.00\(accn.2\))
• Zyxel WAX630S Firmware: before 7.00\(abzd.2\) (fixed in 7.00\(abzd.2\))
• Zyxel WAX640S-6e Firmware: before 7.00\(accm.2\) (fixed in 7.00\(accm.2\))
• and 4 more

Published 2024-09-03. Last modified 2026-06-17.