CVE-2024-29973
CVSS v3
9.8
CRITICAL
EPSS Score
94.1 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Technical details
- Published
- 2024-06-04
Frequently asked questions
What is CVE-2024-29973?
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
Is CVE-2024-29973 actively exploited?
Active exploitation of CVE-2024-29973 has not been confirmed. The EPSS score is 94.1%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-29973?
CVE-2024-29973 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-29973 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 30 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).