CVE-2024-29972
📋 TL;DR
This is a critical command injection vulnerability in Zyxel NAS devices that allows unauthenticated attackers to execute arbitrary operating system commands via crafted HTTP POST requests to the 'remote_help-cgi' CGI program. It affects Zyxel NAS326 and NAS542 devices with outdated firmware, potentially leading to complete system compromise.
💻 Affected Systems
- Zyxel NAS326
- Zyxel NAS542
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover, data theft, ransomware deployment, lateral movement to other network devices, and persistent backdoor installation.
Likely Case
Unauthenticated remote code execution leading to data exfiltration, cryptocurrency mining, or device addition to botnets.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound rules and network segmentation.
🎯 Exploit Status
Exploitation requires sending a single crafted HTTP POST request. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NAS326: V5.21(AAZF.17)C0 or later, NAS542: V5.21(ABAG.14)C0 or later
Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
Restart Required: Yes
Instructions:
1. Download latest firmware from Zyxel support portal. 2. Log into NAS web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and apply firmware file. 5. Reboot device after update completes.
🔧 Temporary Workarounds
Block Web Interface Access
linuxRestrict access to NAS web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote management features in NAS configuration
🧯 If You Can't Patch
- Immediately isolate affected devices from internet and critical network segments
- Implement strict network access controls allowing only necessary traffic to NAS devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in NAS web interface under Maintenance > System InformationCheck Version:
Login to web interface and navigate to Maintenance > System InformationVerify Fix Applied:
Confirm firmware version matches or exceeds patched versions: NAS326 >= V5.21(AAZF.17)C0, NAS542 >= V5.21(ABAG.14)C0📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/remote_help-cgi with unusual parameters
- Unusual process execution from web server user
Network Indicators:
- HTTP POST requests to NAS devices on port 80/443 containing shell metacharacters
- Outbound connections from NAS to suspicious IPs
SIEM Query:
source="nas_logs" AND (url="/cgi-bin/remote_help-cgi" AND method="POST")🔗 References
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
