CVE-2024-6342

Published: Sep 10, 2024Modified: Jan 22, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@zyxel.com.tw (Secondary)

Description

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected (4)

Products: Zyxel: Nas326 Firmware, Nas542 Firmware

Zyxel

2 products

Nas326 Firmware

Nas542 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nas326 Firmware	Before 5.21\(aazf.18\)c0
Zyxel Nas326 Firmware	Version 5.21(aazf.18)c0

Running on/with	Platform Versions
Zyxel Nas326	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zyxel Nas542 Firmware	Before 5.21\(abag.15\)c0
Zyxel Nas542 Firmware	Version 5.21(abag.15)c0

Running on/with	Platform Versions
Zyxel Nas542	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024

Source: security@zyxel.com.tw

Vendor Advisory

Timeline

No history available yet.