{"id":"CVE-2021-4039","published":"2022-03-01T06:40:09Z","modified":"2024-08-03T17:16:03Z","title":"A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to…","vendor":"Zyxel","product":"NWA1100-NH firmware","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zyxel","product":"NWA1100-NH firmware","versions":["2.12(AASI.0)C0"]}],"description":{"text":"A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.","provenance":"source","from":"CVE.org"},"summary":{"text":"A command injection flaw in the web interface of the Zyxel NWA1100-NH firmware allows arbitrary operating system commands to be run on the device. An attacker needs network access to the web interface and requires no authentication or user interaction, since the vector shows the attack is network-reachable with low complexity and no privileges required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:17Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71048,"percentile":0.99404,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-05-26","exploitedFirstSeen":"2022-05-26","ransomware":false,"evidence":[{"url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","date":"2022-05-26"},{"url":"https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"},{"url":"https://cujo.com/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"},{"name":"Recently discovered vulnerabilities are exploited by EnemyBot malware.","url":"https://otx.alienvault.com/pulse/62bb3cd8e18ca5252dcdd059","created":"2022-06-28"},{"name":"Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices | AT&T Alien Labs","url":"https://otx.alienvault.com/pulse/6295f2c308cccc2f34088b6b","created":"2022-05-31"},{"name":"EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities","url":"https://otx.alienvault.com/pulse/6295cdc589590f0ab7f34423","created":"2022-05-31"},{"name":"Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices | AT&T Alien Labs","url":"https://otx.alienvault.com/pulse/6295c89ad9162c33ab43f4c1","created":"2022-05-31"},{"name":"Rapidly Evolving EnemyBot Botnet Adds New Exploits to Target CMS Servers and Android Devices","url":"https://otx.alienvault.com/pulse/6294baaa70a4d1293968b434","created":"2022-05-30"},{"name":"Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices | AT&T Alien Labs","url":"https://otx.alienvault.com/pulse/62914d2c3694e482fa57f83e","created":"2022-05-27"},{"name":"ZyXEL Wireless Access Point Multiple Vulnerabilities","url":"https://otx.alienvault.com/pulse/6225feb7b4ebf444eb64ad0a","created":"2022-03-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-33939","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33939","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50870,"url":"https://www.exploit-db.com/exploits/50870","title":"Zyxel NWA-1100-NH - Command Injection","type":"remote","platform":"hardware","date":"2022-04-19","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-04-19"},"first":{"date":"2022-04-19","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/50870"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166752/Zyxel-NWA-1100-NH-Command-Injection.html"],"flow":[],"timeline":[{"date":"2022-03-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4039","provenance":"source"},{"date":"2022-04-19","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-50870)","url":"https://www.exploit-db.com/exploits/50870","provenance":"source"},{"date":"2022-05-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cybersecurity.att.com/blogs/labs-research/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers","provenance":"source"}],"speed":{"daysToPublicExploit":49,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1619 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}