CVE-2024-6342

An attacker sends a crafted HTTP POST request to the vulnerable export-cgi program on the NAS device. The program incorrectly processes input data, allowing injection and execution of arbitrary operating system commands. The attack can be carried out remotely over the network without requiring any credentials.

An attacker can execute arbitrary operating system commands on the attacked NAS device, which in practice means full takeover of the device — including access to stored data, configuration modification, or complete device shutdown.

Zyxel NAS326 and NAS542 products are officially unsupported by the manufacturer. Devices should be withdrawn from use as soon as possible or isolated from external networks. If continued use is necessary — restrict access to the management interface exclusively to trusted IP addresses and monitor unexpected HTTP traffic. Details available in the Zyxel security advisory dated 2024-09-10.

Zyxel NAS326 with firmware versions up to and including V5.21(AAZF.18)C0 and Zyxel NAS542 with firmware versions up to and including V5.21(ABAG.15)C0. It should be noted that these products were marked as unsupported (UNSUPPORTED) at the time of CVE assignment.