CVE-2024-29973: ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and…

** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Affected

Detection & IOCsextracted from sources · hover to see the quote

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zyxel NAS Unauthorized Command Injection in setCookie Parameter (CVE-2024-29973)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cmd|2c|"; startswith; content:"/register_main/setCookie"; fast_pattern; endswith; http.request_body; content:"c0|3d|"; reference:cve,2024-29973; reference:url,outpost24.com/blog/zyxel-nas-critical-vulnerabilities; classtype:web-application-attack; sid:2055908; rev:1; metadata:affected_product Zyxel, attack_target Server, tls_state plaintext, created_at 2024_09_18, cve CVE_2024_29973, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_09_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• →Detect HTTP POST requests targeting the vulnerable endpoint: URI must start with '/cmd,' (URL-encoded as '/cmd|2c|') and end with '/register_main/setCookie' ↗
• →Inspect HTTP POST body for the 'c0=' parameter (URL-encoded 'c0|3d|') containing Python subprocess injection payload using __import__("subprocess").check_output with shell=True ↗
• →The exploit uses multipart/form-data with boundary '----WebKitFormBoundarygcflwtei' and the injection is in the 'c0' form field ↗
• →Use FOFA query 'app="ZYXEL-NAS326"' to identify exposed Zyxel NAS326 devices on the internet for proactive asset identification ↗

• ·CVE-2024-29975 and CVE-2024-29976 (privilege escalation and session/cookie disclosure) were NOT patched by Zyxel even in the emergency update, meaning patched devices may still be at risk from authenticated local attackers or session hijacking ↗
• ·Public PoC exploits are available, significantly raising exploitation likelihood; EPSS score is 0.94053 (99.9th percentile), indicating very high probability of exploitation in the wild ↗

CVSS provenance