Description
Zyxel NAS326存在命令注入漏洞，此漏洞是由于setCookie未充分验证用户输入的数据所导致的。
Zyxel NAS326 CVE-2024-29972 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-29972
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-nas-products-06-04-2024
https://outpost24.com/blog/zyxel-nas-critical-vulnerabilities/
https://cvefeed.io/vuln/detail/CVE-2024-29972
https://heimdalsecurity.com/blog/zyxel-patches-eol-nas-vulnerabilities/
https://www.venustech.com.cn/new_type/aqtg/20240604/27599.html
https://community.zyxel.com/en/discussion/25870/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products
https://cve.imfht.com/detail/CVE-2024-29972
https://avd.aliyun.com/detail?id=AVD-2024-29972
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29972.yaml