CVE-2024-29972

CriticalCVSS 9.8

Published: 04/06/2024(UTC)Updated: 03/11/2026(UTC)Translated: 03/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

90.35%

100th percentile - higher than 100% of all known CVEs

Summary

A command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute OS commands by sending a crafted HTTP POST request.

Risk Assessment

An unauthenticated attacker can remotely execute arbitrary OS commands on the NAS device, potentially leading to full device compromise and access to stored data.

Recommendation

Update Zyxel NAS326 firmware to version V5.21(AAZF.17)C0 or later and NAS542 to version V5.21(ABAG.14)C0 or later.

Other vulnerabilities in Zyxel NAS

CVE-2023-27992CriticalActively exploited
Pre-authentication command injection vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 prior to V5.21(AATB.11)C0, and NAS542 prior to V5.21(ABAG.11)C0. An unauthenticated attacker could execute OS commands remotely by sending a crafted HTTP request.

Original NVD description (English source)

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS