CVE-2024-29974

The vulnerability (CWE-434 — unrestricted upload of file with dangerous type) lies in the CGI program 'file_upload-cgi' that handles configuration file uploads. An unauthenticated attacker can upload a crafted configuration file to the vulnerable device accessible over the network. Lack of proper file verification allows execution of malicious code contained in the file on the device.

An attacker gains the ability to execute arbitrary code on the vulnerable device from the network without needing any credentials, which may lead to complete takeover of the NAS device along with stored data.

Update Zyxel NAS326 firmware to version V5.21(AAZF.17)C0 or later, and Zyxel NAS542 to version V5.21(ABAG.14)C0 or later. Due to the end-of-support status of these devices, replacing them with actively supported models is recommended. Until the patch is applied, restrict network access to the device management interface — especially block exposure to the public internet.

Zyxel NAS326 with firmware versions prior to V5.21(AAZF.17)C0 and Zyxel NAS542 with firmware versions prior to V5.21(ABAG.14)C0. The manufacturer marked these devices as UNSUPPORTED at the time of vulnerability assignment.