Zyxel urges users to apply patches for three critical vulnerabilities impacting two of its end-of-life NAS products

Security researcher Timothy Hjort reported 5 vulnerabilities in Zyxel products:

  • NAS326, version V5.21(AAZF.16)C0 and earlier
  • NAS542, version V5.21(ABAG.13)C0 and earlier

Three of the flaws are critical and enable command injection and remote code execution (RCE) attacks.

End-of-life means that the vendor no longer supports the product, but due to these three critical vulnerabilities, Zyxel announced making an exception.

What are the five Zyxel vulnerabilities?

For the moment, Zyxel says there is no proof of hackers exploiting the vulnerabilities in the wild. But there’s already an available proof-of-concept available on the Internet. So, users should apply the available patches as soon as possible.

According to BleepingComputer.com, Zyxel only released fixes for CVE-2024-29972, CVE-2024-29973, and CVE-2024-29974. You can download patches here.

zyxel patches eol nas vulnerabilities screenshot

Here’s a list and description of all 5 Zyxel vulnerabilities:


CVE-2024-29972 is a command injection vulnerability in the CGI program “remote_help-cgi”. An unauthenticated attacker can exploit it to run commands on some operating system (OS), by sending a crafted HTTP POST request.


This is also a command injection flaw. CVE-2024-29973 resides in the “setCookie” parameter of  Zyxel NAS326 and NAS542 devices. Just like CVE-2024-29972, CVE-2024-29973 can enable unauthenticated hackers to run OS commands through crafted HTTP POST requests.


This remote code execution vulnerability was found in the CGI program “file_upload-cgi” in Zyxel NAS326 and NAS542. Hackers can use CVE-2024-29974 to execute arbitrary code by uploading a crafted configuration file to a compromised device.


CVE-2024-29975 is an improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 and NAS542. Hackers can exploit it to get administrator privileges and run system commands as the “root” user on an already compromised device.


This is another privilege management flaw, found in the command “show_allsessions” in Zyxel NAS326 and NAS542 devices. Once the attacker succeeds authenticating, they can exploit CVE-2024-29976 to gain a logged-in administrator’s session information containing cookies on a vulnerable device.

If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.

Author Profile

Livia Gyongyoși is a Communications and PR Officer within Heimdal®, passionate about cybersecurity. Always interested in being up to date with the latest news regarding this domain, Livia’s goal is to keep others informed about best practices and solutions that help avoid cyberattacks.