Improper Privilege Management Vulnerability Affects Zyxel NAS326 Firmware
CVE-2024-29976

6.5MEDIUM

Key Information:

Vendor
Zyxel
Status
Nas326 Firmware
Nas542 Firmware
Vendor
CVE Published:
4 June 2024

Summary

** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.

Affected Version(s)

NAS326 firmware < V5.21(AAZF.17)C0

NAS542 firmware < V5.21(ABAG.14)C0

References

https://www.zyxel.com/global/en/support/security-advisori...
vendor-advisory
https://outpost24.com/blog/zyxel-nas-critical-vulnerabili...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.