CVE-2024-29972
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 89%
from disclosure to weapon16 days
Published on NVDJun 4
1st PoC+16d
VulnCheck+368d
exploitation probability
89%top 1% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 4
githubgithub.com/Pommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-poc★ 4githubgithub.com/WanLiChangChengWanLiChang/CVE-2024-29972★ 1vulncheckvulncheck.com/xdb/891f1dbf629cunverifiedvulncheckvulncheck.com/xdb/273c11d4d33bunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.