Vulnerability · Published Jun 4, 2024 · Assigned by Zyxel

CVE-2024-29975

Medium 6.7

In plain English

A medium-severity privilege mismanagement in NAS326 firmware from Zyxel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.

Affected products (as reported)

Vendor	Product	Versions
Zyxel	NAS326 firmware	< V5.21(AAZF.17)C0
Zyxel	NAS542 firmware	< V5.21(ABAG.14)C0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References