CVE-2024-29974

PoC —

CVSS 3.1

9.8 critical

EPSS

23%p98

Published

Jun 4, 2024 (Jun 4, 2024)

Modified

Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

Vendors: zyxel
Products: nas326 firmware, nas542 firmware
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (22.8%)

In the news4 stories

Zyxel patches critical flaws in EOL NAS devices

Help Net SecurityJun 25, 18:19 UTC · Jun 25, 2024Vulnerability in the wildCVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs

Zyxel Releases Patches for Firmware Vulnerabilities in EoL NAS Models

The Hacker NewsJun 25, 03:24 UTC · Jun 25, 2024Model release in the wildCVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs

Week in review: Atlassian Confluence RCE PoC, new Kali Linux, Patch Tuesday forecast

Help Net SecurityJun 9, 00:00 UTC · Jun 9, 2024Exploit / PoC CVE-2024-21683 CVE-2024-28995 CVE-2024-29972+4 CVEs

Zyxel addressed three RCEs in end-of

Security AffairsJun 5, 08:01 UTC · Jun 5, 2024Exploit / PoC CVE-2024-29972 CVE-2024-29973 CVE-2024-29974+2 CVEs