CVE-2024-29973 Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection · CloudMap

严重CVE-2024-29973RCE

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection

披露于 2024/06/04 · 更新于 2025/08/01

CVSS 评分9.9/ 10.0

EPSS 概率93.8%百分位 99.8%

漏洞描述

The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

影响产品

合勤科技nas326查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

outpost24.comhttps://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/↗x.comhttps://x.com/sirifu4k1/status/1803267896656929099/photo/1↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-29973↗

RELATED INTELLIGENCE

同产品关联漏洞

与 nas326 相关的其他公开漏洞。

查看全部 →

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2024-29972RCE Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account nas326	严重	9.9	91.5%	PoCEXP	2024/06/04
CVE-2023-4474RCE Zyxel NAS326 操作系统命令注入漏洞(CVE-2023-4474) nas326	严重	9.8	16.3%	PoCEXP	2023/11/30
CVE-2023-27992 CVE-2023-27992 NAS540 NAS542 nas326	严重	9.8	88.5%	PoCEXP	2023/06/19
CVE-2020-9054RCE Zyxel NAS Firmware 5.21- Remote Code Execution nas326	严重	9.8	94.3%	PoCEXP	2020/03/05