CVE-2024-29974
📋 TL;DR
This critical vulnerability allows unauthenticated attackers to execute arbitrary code on affected Zyxel NAS devices by uploading a crafted configuration file to the vulnerable CGI program. It affects Zyxel NAS326 and NAS542 devices running outdated firmware versions. Attackers can gain full control of the device without any authentication.
💻 Affected Systems
- Zyxel NAS326
- Zyxel NAS542
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the NAS device leading to data theft, ransomware deployment, lateral movement to connected systems, and persistent backdoor installation.
Likely Case
Unauthenticated remote code execution allowing attackers to steal sensitive data, install malware, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if device is isolated, patched, or has strict network access controls preventing external exploitation.
🎯 Exploit Status
Public exploit details available in security advisories. Simple file upload leads to RCE without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NAS326: V5.21(AAZF.17)C0 or later, NAS542: V5.21(ABAG.14)C0 or later
Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
Restart Required: Yes
Instructions:
1. Download latest firmware from Zyxel support portal. 2. Log into NAS web interface. 3. Navigate to Maintenance > Firmware Upgrade. 4. Upload and apply the firmware file. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Disable CGI access via firewall
linuxBlock external access to the vulnerable CGI endpoint using network firewall rules.
iptables -A INPUT -p tcp --dport 80 -m string --string "file_upload-cgi" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "file_upload-cgi" --algo bm -j DROP
Remove CGI file
linuxDelete or rename the vulnerable CGI program file if not needed.
rm /path/to/file_upload-cgi
mv /path/to/file_upload-cgi /path/to/file_upload-cgi.disabled
🧯 If You Can't Patch
- Immediately isolate the NAS device from internet access and restrict network access to trusted IPs only.
- Implement strict file upload filtering and monitoring for any configuration file upload attempts.
🔍 How to Verify
Check if Vulnerable:
Check firmware version in NAS web interface under Maintenance > System Information. Compare against patched versions.Check Version:
ssh admin@nas-ip 'cat /etc/version' or check web interfaceVerify Fix Applied:
Confirm firmware version shows V5.21(AAZF.17)C0 or later for NAS326, or V5.21(ABAG.14)C0 or later for NAS542.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to CGI endpoints
- Unexpected process execution from CGI context
- Failed authentication attempts followed by successful file upload
Network Indicators:
- HTTP POST requests to /cgi-bin/file_upload-cgi with unusual file extensions
- Outbound connections from NAS to unknown IPs
SIEM Query:
source="nas_logs" AND (uri="/cgi-bin/file_upload-cgi" OR process="file_upload-cgi")🔗 References
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
- https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
