Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
A command injection vulnerability exists in the export-cgi program of Zyxel NAS326 and NAS542 devices. This vulnerability affects NAS326 firmware versions up to and including V5.21(AAZF.18)C0, and NAS542 firmware versions up to and including V5.21(ABAG.15)C0. The vulnerability allows an unauthenticated attacker to execute operating system (OS) commands by sending a crafted HTTP POST request.
This vulnerability has a severe impact potential. An attacker exploiting this vulnerability could execute arbitrary OS commands on the affected Zyxel NAS devices without authentication. This could lead to complete compromise of the device, including: 1. Unauthorized access to sensitive data stored on the NAS. 2. Modification or deletion of data. 3. Use of the compromised device as a foothold for further network intrusion. 4. Potential disruption of services provided by the NAS. The CVSS v3.1 base score of 9.8 (Critical) indicates the highest severity level, with high impacts on confidentiality, integrity, and availability.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
As of the vulnerability disclosure, there is no mention of an available patch. The vulnerability description states "UNSUPPORTED WHEN ASSIGNED," which suggests that the affected versions may no longer be supported by the vendor. Users should check Zyxel's official channels for any updates or advisories regarding this vulnerability.
Given the critical nature of this vulnerability and the lack of an immediate patch, the following mitigation steps are recommended: 1. Immediate isolation: Remove affected Zyxel NAS devices from public network access or place them behind a firewall that restricts access to trusted IP addresses only. 2. Monitor for suspicious activities: Implement robust logging and monitoring for any unusual access attempts or command executions on these devices. 3. Update firmware: Check Zyxel's website regularly for any new firmware releases that may address this vulnerability, and apply updates as soon as they become available. 4. Consider replacement: If updates are not forthcoming, consider replacing the affected devices with newer, supported models or alternative NAS solutions. 5. Network segmentation: Ensure NAS devices are on a separate network segment with restricted access. 6. Regular security assessments: Conduct frequent security scans and penetration tests to identify and address any potential exploits.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-6342. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-6342
A CVSS base score of 9.8 has been assigned.
Attacks in the wild have been reported by Help Net Security. See article
EPSS Score was set to: 0.09% (Percentile: 39.1%)