Critical severity9.8NVD Advisory· Published Jun 4, 2024· Updated Jun 17, 2026

CVE-2024-29974

Description

UNSUPPORTED WHEN ASSIGNED The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zyxel/NAS326llm-fuzzy
Range: <V5.21(AAZF.17)C0
Zyxel/NAS542llm-fuzzy
Range: <V5.21(ABAG.14)C0
Zyxel/NAS326 firmwarev5
Range: < V5.21(AAZF.17)C0
Zyxel/NAS542 firmwarev5
Range: < V5.21(ABAG.14)C0

Patches

Vulnerability mechanics

References

outpost24.com/blog/zyxel-nas-critical-vulnerabilities/nvdExploitThird Party Advisory
www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.018
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000