Skip to content
OpenAdvisories
Critical · 9.8 CVE-2024-29974 EUVD-2024-26948GHSA-f3hm-gpcm-pwvf

** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versi…

Published Jun 4, 2024 · Updated Aug 2, 2024 · Assigned by Zyxel

Vendor: Zyxel Product: NAS326 firmware Product: NAS542 firmware Category: Network devices

Description

** UNSUPPORTED WHEN ASSIGNED **
The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

Affected products

VendorProductAffectedFixed
Zyxel NAS326 firmware < V5.21(AAZF.17)C0 —
Zyxel NAS542 firmware < V5.21(ABAG.14)C0 —

References