This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Zyxel NAS326 and NAS542 fix 5 vulnerabilities

Zyxel is fixing 5 vulnerabilities in NAS326 and NAS542. The vulnerabilities are fixed in version V5.21(AAZF.17)C0 for NAS326 and version V5.21(ABAG.14)C0 for NAS542 [1].

Zyxel NAS326, NAS542 - command injection
CVSS 9.8 (Critical)

An unauthenticated remote attacker can run system commands on the affected device without authorization using specially crafted HTTP POST requests [1][2][3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 6. 2024.

Zyxel NAS326, NAS542 - code execution (CVE-2024-29974)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute arbitrary code on the affected device without authorization by uploading a specially crafted configuration file [1][4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 6. 2024.

Zyxel NAS326, NAS542 - command execution (CVE-2024-29975)
CVSS 6.7 (Medium)

An authenticated local attacker with administrator privileges can execute some commands with root privileges in the operating system of the vulnerable device [1][5].

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 3. 6. 2024.

Zyxel NAS326, NAS542 - code execution (CVE-2024-29976)
CVSS 6.5 (Medium)

An authenticated remote attacker can obtain, without authorization, session information of a logged-in administrator, including cookies [1][6].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 3. 6. 2024.

By CESNET, z.s.p.o. Martin Krajči on 4. 6. 2024.

CESNET, z.s.p.o. Logo