CVE-2024-29973

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-299749.8** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versio CVE-2024-299756.7** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versi CVE-2024-299766.5** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware v CVE-2024-299774.3Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allow CVE-2024-299785.9User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump fi CVE-2024-299793.3Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel CVE-2024-29985.4A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been rated as problematic. Affected by th CVE-2024-299803.3Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel CVE-2024-299814.3Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2024-299828.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-299838.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability CVE-2024-299848.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability