CVE-2024-29973: Zyxel NAS unauthenticated command injection, exploited by botnets
The short version: CVE-2024-29973 is an unauthenticated OS command-injection flaw in Zyxel NAS326 and NAS542 storage devices. A crafted HTTP POST to the setCookie parameter runs commands on the device — no login required. These models are end-of-life, they're being swept up by a Mirai-like botnet, and it scores a 9.8. It isn't in CISA's KEV catalog, but that's cold comfort given active exploitation. Steady hands — but move: patch the extended-support firmware or get these off the internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (Zyxel, CNA) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 86.1% · 99.7th percentile (2026-07-17) |
| In CISA KEV? | No — not listed as of writing |
| Known exploited? | Yes — active exploitation reported by a Mirai-like botnet; public PoC available |
| Vulnerability type | CWE-78 OS command injection → unauthenticated remote command execution (root) |
| Requires authenticated session? | No — pre-authentication |
| Affected | NAS326 before V5.21(AAZF.17)C0 · NAS542 before V5.21(ABAG.14)C0 (both end-of-life) |
| Fixed in | NAS326 V5.21(AAZF.17)C0 · NAS542 V5.21(ABAG.14)C0 (extended-support patches) |
What you need to know
CVE-2024-29973 is a command injection in the setCookie parameter of Zyxel's NAS326 and NAS542 web interface. Because user input isn't sanitized before being used in a system command, an unauthenticated attacker who can reach the device sends one crafted POST and executes arbitrary OS commands.
A few things make this one worse than the average appliance bug:
- It's an internet-facing storage device. These NAS boxes hold files and often sit exposed for remote access — command execution reaches the data directly.
- It's pre-authentication and trivially automatable. No credential, one request; the high EPSS reflects how mechanical exploitation is.
- The hardware is end-of-life. Both models reached end-of-vulnerability-support in December 2023. Zyxel released patches for these two critical flaws anyway, but many units are unmanaged and forgotten.
- Botnets are already on it. Researchers reported a Mirai-like botnet exploiting this in the wild, and a proof-of-concept is public.
How serious we see it
High — in practice, even though it isn't in CISA's KEV catalog.
The 9.8 is earned: unauthenticated, network-reachable command execution on an internet-exposed device, with a public exploit and active botnet abuse. We don't wait for a KEV listing to call that what it is. If anything, the end-of-life status raises the stakes — these are the boxes least likely to be patched or watched.
The bounded, reassuring part: it affects two specific models below specific firmware builds, Zyxel published fixes despite EOL, and exposure is quick to confirm. Where the device can simply come off the internet, that closes it outright.
Recommendations
Straight from Zyxel's advisory:
- Patch now. Update NAS326 to V5.21(AAZF.17)C0 and NAS542 to V5.21(ABAG.14)C0 or later. (Note a later flaw, CVE-2024-6342, was addressed in a subsequent Zyxel advisory — track both.)
- Get these devices off the public internet. If patching isn't immediate, disable the web management interface or restrict it to trusted administrator IPs.
- Plan replacement. These models are end-of-life; move to currently supported hardware that still receives security updates.
- Hunt for prior use. These devices are frequently compromised in chains — review for unexpected processes, accounts, or outbound connections; assume a reachable, unpatched unit may have been touched.
- Confirm your exposure first. Verify whether any NAS326 or NAS542 is internet-reachable and below the fixed firmware.
How BreachRisk sees it
BreachRisk finds this the way an attacker would. From little more than your domain it discovers internet-facing Zyxel NAS interfaces, fingerprints the model, and flags exposure tied to this actively exploited flaw. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single crafted request that echoes a benign marker and checks for it in the response — confirming command execution actually works, without dropping a payload or disrupting the device.
That's the difference between "this looks like a vulnerable NAS" and "we confirmed unauthenticated command execution" — surfaced before a botnet gets there first.