{"affected":[{"defaultStatus":"unaffected","product":"NAS326 firmware","source":"CNA: Zyxel","vendor":"Zyxel","versions":[{"status":"affected","version":"< V5.21(AAZF.17)C0"}]},{"defaultStatus":"unaffected","product":"NAS542 firmware","source":"CNA: Zyxel","vendor":"Zyxel","versions":[{"status":"affected","version":"< V5.21(ABAG.14)C0"}]},{"defaultStatus":"unknown","product":"nas326_firmware","source":"ADP: CISA-ADP","vendor":"zyxel","versions":[{"lessThan":"v5.21\\(aazf.17\\)co","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"nas542_firmware","source":"ADP: CISA-ADP","vendor":"zyxel","versions":[{"lessThan":"5.21\\(abag.14\\)co","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21\\(aazf.17\\)c0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21\\(abag.14\\)c0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveId":"CVE-2024-29972","cwes":["CWE-78"],"description":"** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the CGI program \"remote_help-cgi\" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.","epss":{"date":"2026-11-03","percentile":0.99799,"score":0.90349},"exploits":[{"kind":"exploit","source":"security@zyxel.com.tw","url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"},{"kind":"exploit","source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"}],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: Zyxel","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: security@zyxel.com.tw","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793750196846,"publishedAt":1717464298172,"references":[{"source":"CNA: Zyxel","tags":["vendor-advisory"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024"},{"source":"CNA: Zyxel","tags":[],"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"},{"source":"security@zyxel.com.tw","tags":["Exploit","Third Party Advisory"],"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"},{"source":"security@zyxel.com.tw","tags":["Vendor Advisory"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024"}],"remediation":[],"revision":"12d2d5a267eff29535e41df557c7ceacc7ec199f1adb8934bda1a5bdaed8328a","sources":[{"modifiedAt":1793750196846,"name":"CNA: Zyxel","retrievedAt":1793750956244,"url":"https://www.cve.org/CVERecord?id=CVE-2024-29972"},{"modifiedAt":1793744237650,"name":"NVD","retrievedAt":1793751351852,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29972"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793743930123,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-29972"}],"ssvc":{"assessedAt":1719374125594,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-29972","updatedAt":1793751351852}