Description
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zyxel | NAS326 firmware | < V5.21(AAZF.17)C0 | — |
| Zyxel | NAS542 firmware | < V5.21(ABAG.14)C0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 6 repositories
-
NanoWraith/CVE-2024-29973 ★ 10 · Jun 20, 2024
-
bigb0x/CVE-2024-29973 ★ 10 · Jun 19, 2024
POC for CVE-2024-29973
-
RevoltSecurities/CVE-2024-29973 ★ 6 · Jun 21, 2024
Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.
-
momika233/CVE-2024-29973 ★ 3 · Jun 19, 2024
-
aerchy/CVE-2024-29973 ★ 2 · Oct 10, 2024
-
p0et08/CVE-2024-29973 ★ 0 · Jun 21, 2024
PoC and Bulk Scanner for CVE-2024-29973
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection http/cves/2024/CVE-2024-29973.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.