How severe is CVE-2024-7261?

CVE-2024-7261 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-7261 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 11% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-7261?

CVE-2024-7261 primarily affects Zyxel Nwa110ax Firmware. In total, 29 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-7261?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-7261 have an EU (EUVD) identifier?

Yes. CVE-2024-7261 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48208.

When was CVE-2024-7261 published?

CVE-2024-7261 was published on 2024-09-03 and last updated on 2026-06-17.

CVE-2024-7261

CVE-2024-7261 is a critical-severity vulnerability in Zyxel Nwa110ax Firmware with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 11% places it in the 95th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-78.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 11% (95th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-48208
Weakness: CWE-78
Affected product: Zyxel Nwa110ax Firmware
Published: 2024-09-03
Last modified: 2026-06-17

Description

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Frequently asked questions

What is CVE-2024-7261?: The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.
How severe is CVE-2024-7261?: CVE-2024-7261 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-7261 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 11% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-7261?: CVE-2024-7261 primarily affects Zyxel Nwa110ax Firmware. In total, 29 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-7261?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-7261 have an EU (EUVD) identifier?: Yes. CVE-2024-7261 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48208.
When was CVE-2024-7261 published?: CVE-2024-7261 was published on 2024-09-03 and last updated on 2026-06-17.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-aps-and-security-router-devices-09-03-2024

Affected products (29)

cpe:2.3:o:zyxel:nwa110ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa1123-ac_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa1123acv3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa130be_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa210ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa220ax-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa50ax_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa55axe_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:nwa90ax_pro_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:usg_lite_60ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac500h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6103d-i_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6502d-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6503d-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6552d-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wac6553d-e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax300h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax510d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax610d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax620d-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax630s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax640s-6e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax650s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wax655e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wbe530_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:zyxel:wbe660s_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Zyxel Nwa110ax Firmware

CVE-2024-12398 — High (CVSS 8.8): An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions…
CVE-2022-26532 — High (CVSS 7.8): A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09…
CVE-2025-6265 — High (CVSS 7.2): A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2)…
CVE-2023-6398 — High (CVSS 7.2): A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions…
CVE-2024-1575 — Medium (CVSS 6.5): The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions…
CVE-2023-22918 — Medium (CVSS 6.5): A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32…

All CVEs affecting Zyxel Nwa110ax Firmware →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-56004 — Critical (CVSS 10.0): A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by…
CVE-2026-56415 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is…
CVE-2026-56413 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens…
CVE-2026-49869 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in…
CVE-2026-49261 — Critical (CVSS 10.0): MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through…
CVE-2026-10520 — Critical (CVSS 10.0): An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a…

Browse all CWE-78 (OS Command Injection) vulnerabilities →