CVE-2024-29976

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-29976 has a selected CVSS score of 6.5 (medium); EIP currently links 1 repository PoC.

Description

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 6, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

NAS326 firmware

Browse Zyxel / NAS326 firmware

Default status: unaffected

CVE List< V5.21(AAZF.17)C0affected
Through 5.21(aazf.16)c0affected

NAS542 firmware

Browse Zyxel / NAS542 firmware

Default status: unaffected

CVE List< V5.21(ABAG.14)C0affected
Through 5.21(abag.13)c0affected

Proofs of concept

1

Repository PoCs

GitHubPommaq/CVE-2024-29972-CVE-2024-29976-CVE-2024-29973-CVE-2024-29975-CVE-2024-29974-pocRepository PoCby Pommaq4Not analyzed5 files

11.1 KiB · linked to 5 vulnerabilities

GitHub
PoC details

References

3