CVE-2021-4039 Public exploit Critical · 9.8 EPSS 71.0%
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.
Zyxel · NWA1100-NH firmware
Summary
A command injection flaw in the web interface of the Zyxel NWA1100-NH firmware allows arbitrary operating system commands to be run on the device. An attacker needs network access to the web interface and requires no authentication or user interaction, since the vector shows the attack is network-reachable with low complexity and no privileges required.
Heading is the official description · CVE.org
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
66.7 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 months after disclosure. Public exploit code (Exploit-DB) appeared 49 days after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+49 days
- First seen exploitedVulnCheck KEV evidence+3 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.