External risk intelligence

Zyxel NAS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-29972

The vulnerability resides in a CGI program on network-attached storage (NAS) devices. These products are frequently deployed in environments where their web-based administrative or management interfaces are exposed to the internet to facilitate remote file access and device management, making the vulnerable HTTP POST interface reachable from external networks in many common deployment scenarios.

OS Command Injection

Zyxel Nas326 Firmware

before 5.21\(aazf.17\)c0before 5.21\(abag.14\)c0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified in specific Zyxel network-attached storage (NAS) devices. This issue allows an attacker to execute operating system commands remotely without needing any prior authentication, posing a significant risk to the integrity and security of the affected devices.

Attackers can run commands on affected devices.
Critical remote control vulnerability impacting NAS devices.
Confirm exposure to understand potential business risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted HTTP POST request to the "remote_help-cgi" program. This program, part of the device's web interface, is accessible over the network. If successful, the attacker could execute arbitrary operating system commands on the affected Zyxel NAS devices.

No authentication required.
Triggered by crafted HTTP POST request.
Leads to OS command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary operating system commands on affected Zyxel NAS devices by sending a specially crafted HTTP POST request to the "remote_help-cgi" program. This could impact the confidentiality, integrity, and availability of the device and any data it stores.

System commands and configuration data at risk.
Remote unauthenticated HTTP POST request.
Potential compromise of device and stored data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical command injection vulnerability in Zyxel NAS devices requires immediate attention from teams responsible for network-attached storage and application security. The first practical step is to inventory all Zyxel NAS326 and NAS542 devices, determine their internet reachability and business criticality, and identify the accountable system owner. Remediation planning should then prioritize the most exposed and critical assets.

Identify NAS device owners and scope.
Verify internet exposure and critical assets.
Coordinate vendor updates and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zyxel NAS326 and NAS542 firmware?

These are the core operating systems for Zyxel network-attached storage devices. Users rely on these NAS units to store, manage, and access files over a network. The firmware provides the web-based administrative interface that allows owners to configure settings and manage remote access features for their data.

What does CWE-78 mean for CVE-2024-29972?

CWE-78 refers to OS command injection. In the context of this vulnerability, it means the software does not properly filter or sanitize user input before passing it to the underlying system. Because of this weakness, an attacker can input specially formatted commands into the remote_help-cgi program, causing the device to execute those commands with system-level privileges.

How is this Zyxel vulnerability triggered?

The flaw is triggered when an attacker sends a malicious HTTP POST request to the remote_help-cgi program on the device. Because this interface handles requests without requiring any login, the attack works even if the user has not authenticated. Requests that do not conform to the specific structure expected by this CGI program will not successfully trigger the command execution.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that this vulnerability resides in a web-based management interface frequently exposed to the internet to allow remote file access. If your device is reachable from the internet, it is in a higher-risk category. Internal-only devices are generally less accessible to external attackers but should still be evaluated.

How do I secure my Zyxel NAS against this issue?

Begin by identifying all NAS326 and NAS542 units in your environment and determining which are accessible from the internet. Once you have an inventory, confirm the current firmware version installed on each device. Prioritize applying the vendor-provided firmware updates—version V5.21(AAZF.17)C0 or later for NAS326, and V5.21(ABAG.14)C0 or later for NAS542—to remove the vulnerable code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.