CVE-2024-6342

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-78

Description

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected products

Zyxel NAS326 firmware: before 5.21\(aazf.18\)c0; 5.21(aazf.18)c0 — fixed in 5.21\(aazf.18\)c0
Zyxel NAS542 firmware: before 5.21\(abag.15\)c0; 5.21(abag.15)c0 — fixed in 5.21\(abag.15\)c0

How to fix

Upgrade to a fixed version: Zyxel NAS326 firmware 5.21\(aazf.18\)c0; Zyxel NAS542 firmware 5.21\(abag.15\)c0. Check the vendor advisory for mitigations.

References

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024

Get alerted when CVE-2024-6342 or the next vulnerability affects your stack