CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-29972Public Exploit

Zyxel NAS326 - RCE (CVE-2024-29972)

PublishedJun 4, 2024
First SeenNov 23, 2024
Last Seen
Reported
CVSS9.8
Zyxel
ZyxelNAS542
nas

Description

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

psychologyCrowdSec Analysis

CVE-2024-29972 is a critical command injection vulnerability in Zyxel network-attached storage products, where unauthenticated attackers can execute operating system commands via a vulnerable CGI endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 9th of October 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-29972 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation efforts target URLs containing /desktop,/cgi-bin/remote_help-cgi/favicon.ico.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-06-04
Rule Released2024-10-09
CrowdSec First Seen2024-11-23

Related Weaknesses

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References