{"id":"CVE-2021-4039","published":"2022-03-01T06:40:09Z","modified":"2024-08-03T17:16:03Z","title":"A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to…","vendor":"Zyxel","product":"NWA1100-NH firmware","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zyxel","product":"NWA1100-NH firmware","versions":["2.12(AASI.0)C0"]}],"description":{"text":"A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.","provenance":"source","from":"CVE.org"},"summary":{"text":"A command injection flaw in the web interface of the Zyxel NWA1100-NH firmware allows arbitrary operating system commands to be run on the device. An attacker needs network access to the web interface and requires no authentication or user interaction, since the vector shows the attack is network-reachable with low complexity and no privileges required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:17Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71048,"percentile":0.99405,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-05-26","exploitedFirstSeen":"2022-05-26","ransomware":false,"evidence":[{"url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","date":"2022-05-26"},{"url":"https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"},{"url":"https://cujo.com/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-33939","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33939","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50870,"url":"https://www.exploit-db.com/exploits/50870","title":"Zyxel NWA-1100-NH - Command Injection","type":"remote","platform":"hardware","date":"2022-04-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-04-19"},"first":{"date":"2022-04-19","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/50870"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html"],"flow":[],"timeline":[{"date":"2022-03-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4039","provenance":"source"},{"date":"2022-04-19","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-50870)","url":"https://www.exploit-db.com/exploits/50870","provenance":"source"},{"date":"2022-05-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","provenance":"source"}],"speed":{"daysToPublicExploit":49,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1620 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}