CVE-2024-29972

An attacker sends a specially crafted HTTP POST request to the 'remote_help-cgi' CGI program available on the NAS device's network interface. The vulnerable program does not properly validate input data provided by the user, allowing arbitrary operating system commands to be injected (command injection, CWE-78). The attack requires no authentication or user interaction, and devices are often directly accessible from the internet as NAS-class solutions.

An attacker can execute arbitrary operating system commands on the vulnerable device, which in practice means complete takeover of control — ability to read, modify or delete data and further movement in the network (lateral movement).

Update Zyxel NAS326 firmware to version V5.21(AAZF.17)C0 or later and Zyxel NAS542 to version V5.21(ABAG.14)C0 or later according to manufacturer recommendations. Due to the fact that the products are officially marked as unsupported, migration to actively supported devices should be considered. Until the patch is applied, restrict access to the device management interface to trusted networks only and block internet access using a firewall.

Zyxel NAS326 with firmware versions earlier than V5.21(AAZF.17)C0 and Zyxel NAS542 with firmware versions earlier than V5.21(ABAG.14)C0. It should be noted that at the time of CVE assignment, these products were marked as unsupported (UNSUPPORTED WHEN ASSIGNED).