TI-2024-05885 Aliases CVE-2024-6342 GHSA-cjpp-26j6-262m

OS command injection in Zyxel NAS326 firmware

MEDIUM 53CWE-78Published 2024-09-10 · Updated 2024-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02064 81st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zyxel	NAS326 firmware	up to V5.21(AAZF.18)C0	—	No fix listed	CNA
Zyxel	NAS542 firmware	up to V5.21(ABAG.15)C0	—	No fix listed	CNA

NAS326 firmware VendorZyxel Affected up to V5.21(AAZF.18)C0 Fixed in — No fix listed CNA
NAS542 firmware VendorZyxel Affected up to V5.21(ABAG.15)C0 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:zyxel:nas326_firmware::::::::	before 5.21\(aazf.18\)c0	Vulnerable	Zyxel
cpe:2.3:o:zyxel:nas326_firmware:5.21\(aazf.18\)c0:-::::::	5.21(aazf.18)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:nas326:-:::::::*	not specified by NVD	Running on	Zyxel
cpe:2.3:o:zyxel:nas542_firmware::::::::	before 5.21\(abag.15\)c0	Vulnerable	Zyxel
cpe:2.3:o:zyxel:nas542_firmware:5.21\(abag.15\)c0:-::::::	5.21(abag.15)c0	Vulnerable	Zyxel
cpe:2.3:h:zyxel:nas542:-:::::::*	not specified by NVD	Running on	Zyxel

cpe:2.3:o:zyxel:nas326_firmware:*:*:*:*:*:*:*:* Versions before 5.21\(aazf.18\)c0 Vulnerable ·Zyxel
cpe:2.3:o:zyxel:nas326_firmware:5.21\(aazf.18\)c0:-:*:*:*:*:*:* Versions 5.21(aazf.18)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:nas326:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
cpe:2.3:o:zyxel:nas542_firmware:*:*:*:*:*:*:*:* Versions before 5.21\(abag.15\)c0 Vulnerable ·Zyxel
cpe:2.3:o:zyxel:nas542_firmware:5.21\(abag.15\)c0:-:*:*:*:*:*:* Versions 5.21(abag.15)c0 Vulnerable ·Zyxel
cpe:2.3:h:zyxel:nas542:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-6342
2026-10-03 Alias added: GHSA-cjpp-26j6-262m

References

Advisory 1

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024

TI-2023-12582 OS command injection in Zyxel NAS326 firmware KEVCVSS 3.1CRITICAL 9.8
TI-2020-07267 OS command injection in Zyxel NAS326 KEVCVSS 3.1CRITICAL 9.8
TI-2024-19735 OS command injection in Zyxel NAS326 firmware CVSS 3.1CRITICAL 9.8
TI-2024-19736 OS command injection in Zyxel NAS326 firmware CVSS 3.1CRITICAL 9.8
TI-2023-04130 OS command injection in Zyxel NAS326 firmware CVSS 3.1CRITICAL 9.8
TI-2023-04129 OS command injection in Zyxel NAS326 firmware CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences