Zyxel Nas326 Firmware vulnerabilities

CVE-2024-29976 [MEDIUM] CWE-269 CVE-2024-29976: ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affec

CVE-2019-10632 [MEDIUM] CWE-22 CVE-2019-10632: A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.

CVE-2024-29975 [MEDIUM] CWE-269 CVE-2024-29975: ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executab ** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a

CVE-2019-10634 [MEDIUM] CWE-79 CVE-2019-10634: An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attac An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.