CVE-2024-29975
First published: Tue Jun 04 2024(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.
Credit: security@zyxel.com.tw
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel NAS326 | <V5.21(AAZF.17)C0 | |
| Zyxel NAS542 firmware | <V5.21(ABAG.14)C0 | |
| All of | ||
| Zyxel NAS326 | <5.21\(aazf.17\)c0 | |
| Zyxel NAS326 | ||
| All of | ||
| Zyxel NAS542 firmware | <5.21\(abag.14\)c0 | |
| Zyxel NAS542 firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-29975?
CVE-2024-29975 is classified as a high-severity vulnerability due to its potential to allow unauthorized privilege escalation.
How do I fix CVE-2024-29975?
To fix CVE-2024-29975, upgrade your Zyxel NAS326 firmware to version V5.21(AAZF.17)C0 or NAS542 firmware to version V5.21(ABAG.14)C0.
Who can exploit CVE-2024-29975?
CVE-2024-29975 can be exploited by authenticated local attackers with administrator privileges on the affected Zyxel devices.
What devices are affected by CVE-2024-29975?
CVE-2024-29975 affects Zyxel NAS326 and NAS542 devices running firmware versions prior to V5.21(AAZF.17)C0 and V5.21(ABAG.14)C0 respectively.
What are the risks associated with CVE-2024-29975?
The risks associated with CVE-2024-29975 include unauthorized access and the ability to execute arbitrary commands due to improper privilege management.
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- collector/the-register
- source/The Register
- alias/CVE-2024-29972
- alias/CVE-2024-29973
- alias/CVE-2024-29974
- alias/CVE-2023-27992
- alias/CVE-2024-29975
- alias/CVE-2024-29976
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/last-modified-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/zyxel
- canonical/zyxel nas326
- canonical/zyxel nas542 firmware