CVE-2024-29972

PoC —1

CVSS 3.1

9.8 critical

EPSS

89%p100

Published

Jun 4, 2024 (Jun 4, 2024)

Modified

Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Vendors: zyxel
Products: nas326 firmware, nas542 firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (89.3%)

In the news4 stories

Zyxel patches critical flaws in EOL NAS devices

Help Net SecurityJun 25, 18:19 UTC · Jun 25, 2024Vulnerability in the wildCVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs

Zyxel Releases Patches for Firmware Vulnerabilities in EoL NAS Models

The Hacker NewsJun 25, 03:24 UTC · Jun 25, 2024Model release in the wildCVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs

Week in review: Atlassian Confluence RCE PoC, new Kali Linux, Patch Tuesday forecast

Help Net SecurityJun 9, 00:00 UTC · Jun 9, 2024Exploit / PoC CVE-2024-21683 CVE-2024-28995 CVE-2024-29972+4 CVEs

Zyxel addressed three RCEs in end-of

Security AffairsJun 5, 08:01 UTC · Jun 5, 2024Exploit / PoC CVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs