CVE-2024-7261

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Sep 3, 2024 / Updated: 2mo ago

010
CVSS 9.8EPSS 0.09%Critical
CVE info copied to clipboard

Summary

An improper neutralization of special elements vulnerability has been identified in the "host" parameter of the CGI program in several Zyxel devices. This vulnerability affects multiple firmware versions across different Zyxel products: - NWA1123ACv3: firmware version 6.70(ABVT.4) and earlier - WAC500: firmware version 6.70(ABVS.4) and earlier - WAX655E: firmware version 7.00(ACDO.1) and earlier - WBE530: firmware version 7.00(ACLE.1) and earlier - USG LITE 60AX: firmware version V2.00(ACIP.2) The vulnerability allows an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device.

Impact

This vulnerability has a critical impact potential. If exploited, an attacker could: 1. Execute arbitrary OS commands on the affected devices, potentially leading to complete system compromise. 2. Gain unauthorized access to sensitive information stored on or passing through the device. 3. Modify system configurations or data, potentially disrupting network operations. 4. Use the compromised device as a pivot point to launch further attacks on the internal network. 5. Cause service disruptions or device malfunctions by executing malicious commands. The severity is underscored by the CVSS v3.1 base score of 9.8 (Critical), with high impacts on confidentiality, integrity, and availability. The attack vector is network-based, requires no user interaction, and can be executed without authentication, making it particularly dangerous.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of a specific patch being available. However, given the critical nature of the vulnerability, it is highly recommended to check for and apply any security updates or patches that Zyxel may release for the affected devices and firmware versions.

Mitigation

While awaiting a patch, consider the following mitigation strategies: 1. Isolate affected devices from untrusted networks, especially the internet, using firewalls or network segmentation. 2. Implement strict access controls to limit who can reach these devices on the network. 3. Monitor logs and network traffic for suspicious activities, particularly focusing on unusual requests to the CGI program. 4. If possible, disable or restrict access to the vulnerable CGI program until a patch is available. 5. Regularly check Zyxel's security advisories for updates on this vulnerability and potential patches. 6. Consider upgrading to newer firmware versions if they become available and are confirmed to address this vulnerability. 7. Implement network intrusion detection/prevention systems (IDS/IPS) to detect and block potential exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-7261. See article

Sep 3, 2024 at 3:11 AM / Vulnerability Archives • Cybersecurity News
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 3, 2024 at 3:11 AM
CVE Assignment

NVD published the first details for CVE-2024-7261

Sep 3, 2024 at 3:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 3, 2024 at 3:20 AM / nvd
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.1%)

Sep 3, 2024 at 9:38 AM
Trending

This CVE started to trend in security discussions

Sep 4, 2024 at 9:20 AM
Threat Intelligence Report

The vulnerability CVE-2024-7261 is rated extremely critical with a CVSS score of 9.8, indicating its severity. It is currently being exploited in the wild by threat actors, with proof-of-concept exploits available. Mitigations, detections, and patches are not yet available, posing downstream impacts to other third party vendors and technology. See article

Sep 6, 2024 at 8:56 PM
Trending

This CVE stopped trending in security discussions

Sep 7, 2024 at 3:37 PM
Static CVE Timeline Graph

Affected Systems

Zyxel/wbe660s_firmware
+null more

Patches

www.zyxel.com
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Zyxel security advisory for OS command injection vulnerability in APs and security router devices
Summary Zyxel has released patches addressing an operating system (OS) command injection vulnerability in some access point (AP) and security router versions. Users are advised to install the patches for optimal protection. What is the vulnerability? The improper neutralization of special elements in the parameter “host” in the CGI program of some AP and security router versions could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device. What versions are vulnerable—and what should you do? After a thorough investigation, we have identified the vulnerable products that are within their vulnerability support period, with their firmware patches shown in the table below. Got a question? Please contact your local service rep or visit Zyxel’s Community for further information or assistance. Acknowledgment Thanks to Chengchao Ai from the ROIS team of Fuzhou University for reporting the issue to us. Revision history 2024-9-3:

News

VulnCheck Initial Access Intelligence Update - September 2024
VulnCheck Initial Access Intelligence equips organizations and security teams with detection artifacts including Suricata signatures, YARA rules, PCAPs, and private exploit PoCs to defend against initial access vulnerabilities that are either already being exploited or likely to be exploited soon. In September 2024, VulnCheck crossed 290+ Initial Access Intelligence (IAI) artifacts, developing artifacts for 16 CVEs, covering 14 different vendors and products.
September 2024: Major Cyber Attacks, Data Breaches, Ransomware Attacks
A major Japanese media company known for producing manga, anime and video games was investigating a cyber attack on its systems following reports that a ransomware group leaked a new batch of its information on the dark web. TFL, Planned Parenthood, Florida-based Slim CD, Fortinet, E-commerce platform Temu are just some of the major organisations that have suffered massive cyber attacks, data breaches and ransomware attacks in September 2024.
Weekly IT Vulnerability Report for August 28, 2024 – September 03, 2024
The Cyble team analyzed critical and high-severity CVEs including those impacting networking products CVE-2024-7261 and CVE-2024-44341 and Dell’s PowerProtect tool CVE-2024-37136, which could lead to remote code execution and information exposure. Create and maintain an incident response plan, and regularly test and update it to ensure effectiveness.
Weekly IT Vulnerability Report for August 28, 2024 – September 03, 2024
The Cyble team analyzed critical and high-severity CVEs including those impacting networking products CVE-2024-7261 and CVE-2024-44341 and Dell’s PowerProtect tool CVE-2024-37136, which could lead to remote code execution and information exposure. Create and maintain an incident response plan, and regularly test and update it to ensure effectiveness.
Weekly IT Vulnerability Report for August 28, 2024 – September 03, 2024
The Cyble team analyzed critical and high-severity CVEs including those impacting networking products CVE-2024-7261 and CVE-2024-44341 and Dell's PowerProtect tool CVE-2024-37136, which could lead to remote code execution and information exposure. Create and maintain an incident response plan, and regularly test and update it to ensure effectiveness.
See 91 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI