Vulnerability · Published Jun 4, 2024 · Assigned by Zyxel
CVE-2024-29976
Medium 6.5
In plain English
A medium-severity privilege mismanagement in NAS326 firmware from Zyxel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.0% (higher than 95% of all known vulnerabilities).
Official description
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zyxel | NAS326 firmware | < V5.21(AAZF.17)C0 |
| Zyxel | NAS542 firmware | < V5.21(ABAG.14)C0 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N