Vulnerability Details CVE-2024-29972
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.925
EPSS Ranking 99.7%
CVSS Severity
CVSS v3 Score 9.8
References
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
Products affected by CVE-2024-29972
-
cpe:2.3:h:zyxel:nas326:-
-
cpe:2.3:h:zyxel:nas542:-
-
cpe:2.3:o:zyxel:nas326_firmware:-
-
cpe:2.3:o:zyxel:nas326_firmware:5.21
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.12)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.13)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.14)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.16)c0
-
cpe:2.3:o:zyxel:nas326_firmware:5.21(aazf.7)c0
-
cpe:2.3:o:zyxel:nas542_firmware:-
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.10)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.11)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.13)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.4)c0
-
cpe:2.3:o:zyxel:nas542_firmware:5.21(abag.9)c0