{"id":"CVE-2024-29973","published":"2024-06-04T01:29:41Z","modified":"2024-08-02T01:17:58Z","title":"** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326…","vendor":"Zyxel","product":"NAS326 firmware","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zyxel","product":"NAS326 firmware","versions":["< V5.21(AAZF.17)C0"]},{"vendor":"Zyxel","product":"NAS542 firmware","versions":["< V5.21(ABAG.14)C0"]}],"description":{"text":"** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.","provenance":"source","from":"CVE.org"},"summary":{"text":"The command injection flaw in the \"setCookie\" parameter affects Zyxel NAS326 firmware before V5.21(AAZF.17)C0 and NAS542 firmware before V5.21(ABAG.14)C0. An unauthenticated remote attacker who sends a crafted HTTP POST request can execute some operating system commands, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.86205,"percentile":0.99733,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-06-24","exploitedFirstSeen":"2024-06-24","ransomware":false,"evidence":[{"url":"https://www.theregister.com/2024/06/24/mirailike_botnet_zyxel_nas/","date":"2024-06-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-27&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-28&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-29&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-30&host_type=src&vulnerability=cve-2024-29973","date":"2024-06-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-24&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-27&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-30&host_type=src&vulnerability=cve-2024-29973","date":"2024-07-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-01&host_type=src&vulnerability=cve-2024-29973","date":"2024-08-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-08-02&host_type=src&vulnerability=cve-2024-29973","date":"2024-08-02"}],"evidenceTotal":483,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"Update 10: Cybercriminals Leverage 66 Vulnerabilities to Target Global Systems","url":"https://otx.alienvault.com/pulse/68651d685fb2301208e89b10","created":"2025-07-02"},{"name":"NCSC Advisory - 18th Sept 2024 - PRC Botnet","url":"https://otx.alienvault.com/pulse/678638141cbf938dbca1090d","created":"2025-01-14"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd56c6fd3f2632e1b4411","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd54761ae1299ecfe27aa","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/66fd391fe0318d98f8af0eb4","created":"2024-10-02"},{"name":"CSA-PRC-LINKED-ACTORS-BOTNET","url":"https://otx.alienvault.com/pulse/66ebe08841abbc50444fbcae","created":"2024-09-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024","tags":["vendor-advisory"]},{"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-26947","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-26947","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2024-06-19","earliestUrl":"https://github.com/momika233/CVE-2024-29973","repos":[{"name":"bigb0x/CVE-2024-29973","url":"https://github.com/bigb0x/CVE-2024-29973","stars":10,"created":"2024-06-19"},{"name":"NanoWraith/CVE-2024-29973","url":"https://github.com/NanoWraith/CVE-2024-29973","stars":10,"created":"2024-06-20"},{"name":"RevoltSecurities/CVE-2024-29973","url":"https://github.com/RevoltSecurities/CVE-2024-29973","stars":6,"created":"2024-06-21"},{"name":"momika233/CVE-2024-29973","url":"https://github.com/momika233/CVE-2024-29973","stars":3,"created":"2024-06-19"},{"name":"aerchy/CVE-2024-29973","url":"https://github.com/aerchy/CVE-2024-29973","stars":2,"created":"2024-10-10"}]},"nuclei":[{"id":"CVE-2024-29973","name":"Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection","severity":"critical","path":"http/cves/2024/CVE-2024-29973.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29973.yaml"}],"first":{"date":"2024-06-19","source":"PoC-in-GitHub","url":"https://github.com/momika233/CVE-2024-29973"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-29973","provenance":"source"},{"date":"2024-06-19","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/momika233/CVE-2024-29973","provenance":"source"},{"date":"2024-06-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.theregister.com/2024/06/24/mirailike_botnet_zyxel_nas/","provenance":"source"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 859 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}