PT-2024-4078 · Zyxel · Zyxel Nas542+1

Timothy Hjort · Published 2024-06-03 · Updated 2025-07-30 · CVE-2024-29973

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 versions prior to V5.21(AAZF.17)C0 Zyxel NAS542 versions prior to V5.21(ABAG.14)C0

Description The command injection vulnerability in the setCookie parameter could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request to the /cmd,/simZysh/register main/setCookie endpoint. It is estimated that 1,194 exposed NAS326 and NAS542 devices, primarily in Europe, are potentially affected. Botnets have been observed exploiting this issue.

Recommendations For Zyxel NAS326 versions prior to V5.21(AAZF.17)C0, update the firmware to V5.21(AAZF.17)C0 or later. For Zyxel NAS542 versions prior to V5.21(ABAG.14)C0, update the firmware to V5.21(ABAG.14)C0 or later. As a temporary workaround, consider restricting access to the setCookie parameter in the /cmd,/simZysh/register main/setCookie endpoint until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-04527

CVE-2024-29973

Affected Products

Zyxel Nas326

Zyxel Nas542

References · 48

• 🔥 https://github.com/bigb0x/CVE-2024-29973 · Exploit
• 🔥 https://github.com/k3lpi3b4nsh33/CVE-2024-29973 · Exploit
• 🔥 https://github.com/RevoltSecurities/CVE-2024-29973 · Exploit
• 🔥 https://github.com/momika233/CVE-2024-29973 · Exploit
• 🔥 https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities · Exploit
• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04527 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29973 · Security Note
• https://twitter.com/linuxpatch/status/1797827173832630462 · Twitter Post
• https://twitter.com/HunterMapping/status/1803727107278987655 · Twitter Post
• https://t.me/brutsecurity/550 · Telegram Post
• https://twitter.com/CveFindCom/status/1797810775945293889 · Twitter Post
• https://twitter.com/darkn3ws/status/1804659502920212493 · Twitter Post
• https://t.me/cvenotify/108309 · Telegram Post