<\/div>\n

Zyxel Networks released an emergency security update to address critical vulnerabilities in end-of-life NAS devices.<\/h2>\n\n\n\n

Zyxel Networks released an emergency security update to address three critical flaws in some of its NAS devices that have reached end-of-life.<\/p>\n\n\n\n

An attacker can exploit the vulnerabilities to perform command injection attacks and achieve remote code execution. Two flaws can also allow attackers to elevate privileges.<\/p>\n\n\n\n

The Outpost24 researcher\u00a0Timothy Hjort reported the flaw to the manufacturer and published<\/strong><\/a> a detailed analysis and PoC exploit codes for the flaws.<\/gwmw><\/p>\n\n\n\n

Below is the list impacting the Zyxel NAS devices:<\/gwmw><\/p>\n\n\n\n

\n
• CVE-2024-29972<\/strong>: This command injection vulnerability in the CGI program \u201cremote_help-cgi\u201d in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.<\/li>\n\n\n\n
• CVE-2024-29973<\/strong>: This command injection vulnerability in the \u201csetCookie\u201d parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request.<\/li>\n\n\n\n
• CVE-2024-29974<\/strong>: This remote code execution vulnerability in the CGI program \u201cfile_upload-cgi\u201d in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.<\/li>\n\n\n\n
• CVE-2024-29975<\/strong>: This improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 and NAS542 devices could allow an authenticated local attacker with administrator privileges to execute some system commands as the \u201croot\u201d user on a vulnerable device.<\/li>\n\n\n\n
• CVE-2024-29976<\/strong>:This improper privilege management vulnerability in the command \u201cshow_allsessions\u201d in Zyxel NAS326 and NAS542 devices could allow an authenticated attacker to obtain a logged-in administrator\u2019s session information containing cookies on an affected device.<\/li>\n<\/ul>\n\n\n\n

  The vulnerabilities affect NAS326\u00a0running firmware versions 5.21(AAZF.16)C0 and earlier, and\u00a0NAS542\u00a0running firmware versions 5.21(ABAG.13)C0 and older.<\/p>\n\n\n\n

  The vendor did not address CVE-2024-29975 and CVE-2024-29976 in its end-of-life products.<\/p>\n\n\n\n

  “Due to the critical severity of vulnerabilities CVE-2024-29972, CVE-2024-29973, and CVE-2024-29974, Zyxel has made patches available to customers with extended support as outlined in the table below, despite the products already having reached end-of-vulnerability-support.” reads the advisory<\/a> published by the company. “Both NAS326 and NAS542 reached end-of-vulnerability-support on Dec. 31, 2023.”<\/em><\/p>\n\n\n\n

  Zyxel is not aware of attacks in the wild exploiting these vulnerabilities.<\/gwmw><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0RCE)<\/strong><\/gwmw><\/p>\n\n\n\n

  <\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  Zyxel Networks released an emergency security update to address critical vulnerabilities in end-of-life NAS devices. Zyxel Networks released an emergency security update to address three critical flaws in some of its NAS devices that have reached end-of-life. An attacker can exploit the vulnerabilities to perform command injection attacks and achieve remote code execution. Two flaws […]<\/p>\n","protected":false},"author":1,"featured_media":112879,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,55],"tags":[4112,9508,9506,10918,3012,687,841,1533,1680],"class_list":["post-164150","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-security","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-nas","tag-pierluigi-paganini","tag-security-affairs","tag-security-news","tag-zyxel"],"yoast_head":"\n