CVE-2021-4039

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-01 · updated 2026-06-17
Weakness: CWE-78

Description

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.

Affected products

Zyxel NWA1100-NH firmware: before 2.12\(aasi.3\)c0 — fixed in 2.12\(aasi.3\)c0

How to fix

Upgrade to a fixed version: Zyxel NWA1100-NH firmware 2.12\(aasi.3\)c0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html
https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml
http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html
https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml

Get alerted when CVE-2021-4039 or the next vulnerability affects your stack