Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-29975

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

Published

2024-06-04T02:15:48.760

Last Modified

2025-01-22T22:48:49.917

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.7 (MEDIUM)

Weaknesses

Type: Secondary
CWE-269
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	zyxel	nas326_firmware	< 5.21\(aazf.17\)c0	Yes
Hardware	zyxel	nas326	-	No
Operating System	zyxel	nas542_firmware	< 5.21\(abag.14\)c0	Yes
Hardware	zyxel	nas542	-	No

References

https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/ Exploit, Third Party Advisory ([email protected])
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 Vendor Advisory ([email protected])
https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)