Zyxel has taken urgent action by releasing software updates to resolve a critical security vulnerability affecting specific access point (AP) and security router versions. This flaw poses a serious risk as it could allow unauthorized individuals to execute commands without permission.
Identified as CVE-2024-7261 with a CVSS score of 9.8, the vulnerability is categorized as an operating system command injection issue. It stems from the failure to properly neutralize special elements in the ‘host’ parameter within the CGI program of certain AP and security router versions. This loophole could be exploited by malicious actors to execute unauthorized OS commands by sending a specially crafted cookie to a vulnerable device, as stated in a recent advisory from Zyxel.
The discovery of this vulnerability was credited to Chengchao Ai from the ROIS team at Fuzhou University. Zyxel has also responded by shipping updates to address eight vulnerabilities in its routers and firewalls, a few of which are rated as high severity:
- CVE-2024-5412 (CVSS score: 7.5) – Buffer overflow vulnerability in the “libclinkc” library that could lead to DoS conditions
- CVE-2024-6343 (CVSS score: 4.9) – Buffer overflow vulnerability triggering DoS conditions
- CVE-2024-7203 (CVSS score: 7.2) – Post-authentication command injection vulnerability enabling execution of OS commands
- CVE-2024-42057 (CVSS score: 8.1) – Command injection vulnerability in the IPSec VPN feature
- CVE-2024-42058 (CVSS score: 7.5) – Null pointer dereference vulnerability causing DoS conditions
- CVE-2024-42059 (CVSS score: 7.2) – Post-authentication command injection vulnerability via FTP
- CVE-2024-42060 (CVSS score: 7.2) – Post-authentication command injection vulnerability in some firewall versions
- CVE-2024-42061 (CVSS score: 6.1) – Reflected cross-site scripting (XSS) vulnerability in the CGI program
In a related development, D-Link has announced that certain security vulnerabilities affecting its DIR-846 router, including critical remote command execution vulnerabilities, will not be patched due to end-of-life status.
If you found this article informative, don’t miss out on more exclusive content by following us on Twitter and LinkedIn.