{"id":"CVE-2024-29973","published":"2024-06-04T01:29:41Z","modified":"2024-08-02T01:17:58Z","title":"** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…","vendor":"Zyxel","product":"NAS326 firmware","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zyxel","product":"NAS326 firmware","versions":["< V5.21(AAZF.17)C0"]},{"vendor":"Zyxel","product":"NAS542 firmware","versions":["< V5.21(ABAG.14)C0"]}],"description":{"text":"** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.","provenance":"source","from":"CVE.org"},"summary":{"text":"The command injection flaw in the \"setCookie\" parameter affects Zyxel NAS326 firmware before V5.21(AAZF.17)C0 and NAS542 firmware before V5.21(ABAG.14)C0. An unauthenticated remote attacker who sends a crafted HTTP POST request can execute some operating system commands, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.86205,"percentile":0.99733,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-06-24","exploitedFirstSeen":"2024-06-24","ransomware":false,"evidence":[{"url":"https://www.theregister.com/2024/06/24/mirailike_botnet_zyxel_nas/","date":"2024-06-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-27&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-28&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-29&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-30&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-24&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-27&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-30&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-01&host_type=src&vulnerability=cve-2024-29973","date":"2024-08-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-02&host_type=src&vulnerability=cve-2024-29973","date":"2024-08-02"}],"evidenceTotal":483,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024","tags":["vendor-advisory"]},{"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-26947","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-26947","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2024-06-19","earliestUrl":"https://github.com/momika233/CVE-2024-29973","repos":[{"name":"bigb0x/CVE-2024-29973","url":"https://github.com/bigb0x/CVE-2024-29973","stars":10,"created":"2024-06-19"},{"name":"NanoWraith/CVE-2024-29973","url":"https://github.com/NanoWraith/CVE-2024-29973","stars":10,"created":"2024-06-20"},{"name":"RevoltSecurities/CVE-2024-29973","url":"https://github.com/RevoltSecurities/CVE-2024-29973","stars":6,"created":"2024-06-21"},{"name":"momika233/CVE-2024-29973","url":"https://github.com/momika233/CVE-2024-29973","stars":3,"created":"2024-06-19"},{"name":"aerchy/CVE-2024-29973","url":"https://github.com/aerchy/CVE-2024-29973","stars":2,"created":"2024-10-10"}]},"nuclei":[{"id":"CVE-2024-29973","name":"Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection","severity":"critical","path":"http/cves/2024/CVE-2024-29973.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29973.yaml"}],"first":{"date":"2024-06-19","source":"PoC-in-GitHub","url":"https://github.com/momika233/CVE-2024-29973"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-29973","provenance":"source"},{"date":"2024-06-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/momika233/CVE-2024-29973","provenance":"source"},{"date":"2024-06-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.theregister.com/2024/06/24/mirailike_botnet_zyxel_nas/","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 860 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}