CVE-2024-6342
📋 TL;DR
This is an unauthenticated command injection vulnerability in Zyxel NAS devices that allows remote attackers to execute arbitrary operating system commands. Attackers can exploit it by sending a crafted HTTP POST request to the export-cgi program. All users of affected Zyxel NAS326 and NAS542 firmware versions are vulnerable.
💻 Affected Systems
- Zyxel NAS326
- Zyxel NAS542
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to other systems, or render the NAS unusable.
Likely Case
Data theft, ransomware deployment, or use as a foothold for lateral movement within the network.
If Mitigated
Limited impact if device is isolated behind strict network controls and firewalls.
🎯 Exploit Status
Unauthenticated exploitation with simple HTTP POST request makes this easily weaponizable. No public PoC known at advisory time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for latest patched versions
Vendor Advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024
Restart Required: Yes
Instructions:
1. Access Zyxel NAS web interface. 2. Navigate to System > Firmware Update. 3. Check for and apply latest firmware. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Isolation
linuxBlock external access to NAS web interface and restrict internal access to trusted IPs only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface
allTemporarily disable web management interface if not needed.
Check Zyxel admin interface for web service disable option
🧯 If You Can't Patch
- Immediately isolate device from internet and restrict network access to minimum required
- Implement strict network segmentation and monitor for suspicious HTTP POST requests to export-cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in NAS web interface under System > InformationCheck Version:
Check via web interface or SSH if enabled: cat /etc/versionVerify Fix Applied:
Confirm firmware version is newer than affected versions listed in advisory📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to export-cgi with unusual parameters
- Unexpected command execution in system logs
- Failed authentication attempts followed by POST requests
Network Indicators:
- HTTP POST to /cgi-bin/export-cgi with command injection patterns
- Unusual outbound connections from NAS device
SIEM Query:
source="nas_logs" AND (uri="/cgi-bin/export-cgi" OR method="POST" AND uri CONTAINS "export-cgi")