On September 3, 2024, Zyxel rolled out crucial patches to address a severe OS command injection vulnerability, tagged as CVE-2024-7261, impacting their Access Points (APs) and security routers. This flaw arises from improper handling of specific elements in the "host" parameter within the CGI program of affected APs and routers, potentially allowing attackers to execute unauthorized OS commands by sending a maliciously crafted cookie.
While we have not yet identified any publicly available proof of concept (PoC) exploit or observed active exploitation of this vulnerability, Zyxel products are no strangers to the crosshairs of cybercriminals, frequently appearing in CISA’s Known Exploited Vulnerabilities catalog. Given the potential access that could be gained through this command injection flaw, it's likely that threat actors will reverse engineer the patches and attempt to exploit this vulnerability soon. Stay vigilant and ensure your devices are up-to-date with the latest security patches.
Upgrade to Latest Fixed Version
We strongly recommend that customers upgrade to the latest fixed version.
| Product | Affected model | Affected version | Patch availability |
|---|---|---|---|
| AP | NWA50AX | 7.00(ABYW.1) and earlier | 7.00(ABYW.2) |
| AP | NWA50AX PRO | 7.00(ACGE.1) and earlier | 7.00(ACGE.2) |
| AP | NWA55AXE | 7.00(ABZL.1) and earlier | 7.00(ABZL.2) |
| AP | NWA90AX | 7.00(ACCV.1) and earlier | 7.00(ACCV.2) |
| AP | NWA90AX PRO | 7.00(ACGF.1) and earlier | 7.00(ACGF.2) |
| AP | NWA110AX | 7.00(ABTG.1) and earlier | 7.00(ABTG.2) |
| AP | NWA130BE | 7.00(ACIL.1) and earlier | 7.00(ACIL.2) |
| AP | NWA210AX | 7.00(ABTD.1) and earlier | 7.00(ABTD.2) |
| AP | NWA220AX-6E | 7.00(ACCO.1) and earlier | 7.00(ACCO.2) |
| AP | NWA1123-AC PRO | 6.28(ABHD.0) and earlier | 6.28(ABHD.3) |
| AP | NWA1123ACv3 | 6.70(ABVT.4) and earlier | 6.70(ABVT.5) |
| AP | WAC500 | 6.70(ABVS.4) and earlier | 6.70(ABVS.5) |
| AP | WAC500H | 6.70(ABWA.4) and earlier | 6.70(ABWA.5) |
| AP | WAC6103D-I | 6.28(AAXH.0) and earlier | 6.28(AAXH.3) |
| AP | WAC6502D-S | 6.28(AASE.0) and earlier | 6.28(AASE.3) |
| AP | WAC6503D-S | 6.28(AASF.0) and earlier | 6.28(AASF.3) |
| AP | WAC6552D-S | 6.28(ABIO.0) and earlier | 6.28(ABIO.3) |
| AP | WAC6553D-E | 6.28(AASG.2) and earlier | 6.28(AASG.3) |
| AP | WAX300H | 7.00(ACHF.1) and earlier | 7.00(ACHF.2) |
| AP | WAX510D | 7.00(ABTF.1) and earlier | 7.00(ABTF.2) |
| AP | WAX610D | 7.00(ABTE.1) and earlier | 7.00(ABTE.2) |
| AP | WAX620D-6E | 7.00(ACCN.1) and earlier | 7.00(ACCN.2) |
| AP | WAX630S | 7.00(ABZD.1) and earlier | 7.00(ABZD.2) |
| AP | WAX640S-6E | 7.00(ACCM.1) and earlier | 7.00(ACCM.2) |
| AP | WAX650S | 7.00(ABRM.1) and earlier | 7.00(ABRM.2) |
| AP | WAX655E | 7.00(ACDO.1) and earlier | 7.00(ACDO.2) |
| AP | WBE530 | 7.00(ACLE.1) and earlier | 7.00(ACLE.2) |
| AP | WBE660S | 7.00(ACGG.1) and earlier | 7.00(ACGG.2) |
| Security router | USG LITE 60AX | V2.00(ACIP.2) | V2.00(ACIP.3)* |
Note: Zyxel has stated security router is updated by cloud.
Please follow your organization’s patching and testing guidelines to avoid any operational impact.
References
Other stories from our Insights blog
Your message has been received!