Back
Critical OS Command Injection Vulnerability (CVE-2024-7261) Affects Zyxel Access Points and Security Routers

Critical OS Command Injection Vulnerability (CVE-2024-7261) Affects Zyxel Access Points and Security Routers

WARNING Publication date: 2024-09-04

Overview Zyxel, a prominent provider of networking devices, has recently disclosed a critical vulnerability identified as CVE-2024-7261. This vulnerability affects multiple models of their access points (APs) and a security router, posing significant risks to users if left unpatched. The flaw allows unauthenticated attackers to execute arbitrary operating system (OS) commands remotely, potentially leading to full device compromise.

Details of CVE-2024-7261 The vulnerability stems from improper neutralization of special elements within the "host" parameter of the CGI program used by the affected devices. By exploiting this weakness, an attacker can send a specially crafted cookie to a vulnerable device, enabling them to execute OS-level commands without needing authentication.

The severity of this vulnerability has been rated 9.8 out of 10 on the CVSS scale, underscoring the critical nature of the threat. The exploitation of this flaw could result in unauthorized access, data breaches, and control over the affected network infrastructure.

Affected Products Zyxel conducted a thorough investigation and identified 28 models of access points, along with the USG LITE 60AX security router, as vulnerable. The following table provides a summary of the affected models and the versions of firmware that are susceptible to this exploit:

Affected Products:

Access Points (APs):

  • NWA50AX, NWA50AX PRO, NWA55AXE, NWA90AX, NWA90AX PRO
  • NWA110AX, NWA130BE, NWA210AX, NWA220AX-6E
  • NWA1123-AC PRO, NWA1123ACv3, WAC500, WAC500H
  • WAC6103D-I, WAC6502D-S, WAC6503D-S, WAC6552D-S, WAC6553D-E
  • WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S
  • WAX640S-6E, WAX650S, WAX655E, WBE530, WBE660S

Security Router:

  • USG LITE 60AX

Action Required:

  • Apply the latest firmware updates provided by Zyxel for each of the affected models.

Mitigation and Recommendations Zyxel has released firmware patches to address this critical vulnerability. Users are strongly advised to apply these patches immediately to protect their devices from potential exploits. Regular software updates and vigilant patch management are crucial practices to ensure the security of network infrastructure.

Conclusion The discovery of CVE-2024-7261 highlights the ongoing risks associated with network device vulnerabilities. With the potential for severe impact, it is imperative that users of the affected Zyxel products act quickly to apply the necessary updates. Zyxel's prompt response and the availability of patches demonstrate the importance of maintaining up-to-date firmware to safeguard against evolving cybersecurity threats.

For further assistance, Zyxel users are encouraged to contact their local service representatives or visit Zyxel’s community forums.