CVE-2024-29975

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-29975 has a selected CVSS score of 6.7 (medium); EIP currently links 1 repository PoC.

Description

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 5, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

NAS326 firmware

Browse Zyxel / NAS326 firmware

Default status: unaffected, unknown

CVE List< V5.21(AAZF.17)C0affected
Before v5.21\(aazf.17\)coaffected

NAS542 firmware

Browse Zyxel / NAS542 firmware

Default status: unaffected, unknown

CVE List< V5.21(ABAG.14)C0affected
Before 5.21\(abag.14\)coaffected

Proofs of concept

1

Repository PoCs

GitHubPommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-pocRepository PoCby Pommaq4Not analyzed5 files

11.1 KiB · linked to 5 vulnerabilities

GitHub
PoC details

References

3