Zyxel has introduced security patches to rectify critical weaknesses affecting two of its network-attached storage (NAS) devices that are currently at end-of-life (EoL) status.
An unauthenticated attacker could potentially execute operating system (OS) commands and arbitrary code on impacted installations by exploiting three out of the five vulnerabilities.
The affected models are NAS326 operating on versions V5.21(AAZF.16)C0 and earlier, and NAS542 operating on versions V5.21(ABAG.13)C0 and earlier. These deficiencies have been fixed in versions V5.21(AAZF.17)C0 and V5.21(ABAG.14)C0, respectively.
A summary of the flaws is as follows –
- CVE-2024-29972 – A command injection vulnerability in the CGI program “remote_help-cgi” that could enable an unauthenticated attacker to execute certain operating system (OS) commands through a crafted HTTP POST request
- CVE-2024-29973 – A command injection vulnerability in the ‘setCookie’ parameter that could allow an unauthenticated attacker to execute specific OS commands via a crafted HTTP POST request
- CVE-2024-29974 – A remote code execution vulnerability in the CGI program ‘file_upload-cgi’ that could grant an unauthenticated attacker the ability to execute arbitrary code by uploading a crafted configuration file
- CVE-2024-29975 – An inappropriate privilege management vulnerability in the SUID executable binary that could permit an authenticated local attacker with administrator privileges to execute certain system commands as the ‘root’ user
- CVE-2024-29976 – An improper privilege management vulnerability in the command ‘show_allsessions’ that could allow an authenticated attacker to acquire a logged-in administrator’s session information containing cookies on an affected device
Credit goes to security researcher Timothy Hjort from Outpost24 for identifying and reporting the five flaws. It is important to note that two of the privilege escalation issues that require authentication remain unaddressed.
Although there is no indication of these vulnerabilities being exploited in real-world scenarios, users are advised to update to the latest version to ensure optimal security.
About Author
