Patchfirst
Patchfirst
CVE-2024-29973 Public exploit Critical · 9.8 EPSS 86.2%

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…

Zyxel · NAS326 firmware

Summary

The command injection flaw in the "setCookie" parameter affects Zyxel NAS326 firmware before V5.21(AAZF.17)C0 and NAS542 firmware before V5.21(ABAG.14)C0. An unauthenticated remote attacker who sends a crafted HTTP POST request can execute some operating system commands, with no authentication or user interaction required.

Official description · CVE.org

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Breakdown
69.2 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 20 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 15 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+15 days
  3. First seen exploitedVulnCheck KEV evidence+20 days

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 10 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

vendor-advisory 1

zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024

Other 1

outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
↑ ↓ chooseEnter openEsc close