CVE-2024-29974

CRITICO 9.8CVE-2024-29974 · Published 04/06/2024 · updated 17/06/2026

In breve

CVE-2024-29974 è una vulnerabilità CRITICO (CVSS 9.8).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 22.8%, superiore al 97.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

References

outpost24.com/blog/zyxel-nas-critical-vulnerabilities · Exploit
zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free