Pommaq

6 exploits Active since Dec 1997
CVE-2024-29973 GITHUB CRITICAL python WORKING POC
Zyxel NAS326 <V5.21(AAZF.17)C0 - Command Injection
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
4 stars
CVSS 9.8
CVE-2024-29974 GITHUB CRITICAL python WORKING POC
Zyxel NAS326 <V5.21(AAZF.17)C0 - RCE
** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.
4 stars
CVSS 9.8
CVE-2024-29975 GITHUB MEDIUM python WORKING POC
Zyxel NAS326 <V5.21(AAZF.17)C0 - Privilege Escalation
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.
4 stars
CVSS 6.7
CVE-2024-29976 GITHUB MEDIUM python WORKING POC
Zyxel NAS326 <V5.21(AAZF.17)C0 - Privilege Escalation
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.
4 stars
CVSS 6.5
CVE-2024-29972 NOMISEC CRITICAL WORKING POC
Zyxel NAS326 <V5.21(AAZF.17)C0 - Command Injection
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
4 stars
CVSS 9.8
CVE-1999-0016 NOMISEC WORKING POC
Cisco Ios - Denial of Service
Land IP denial of service.