CVE-2024-29973 PoC — Zyxel NAS326和Zyxel NAS542 操作系统命令注入漏洞

Source

https://github.com/p0et08/CVE-2024-29973

Associated Vulnerability

Title: Zyxel NAS326和Zyxel NAS542 操作系统命令注入漏洞 (CVE-2024-29973)
Description:** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

Description

PoC and Bulk Scanner for CVE-2024-29973

Readme


One day, I saw this Repositories about CVE-2024-29973 .But after my testing, the script can be executed but it doesn't work. So I made a slight change and it can be used very smoothly!
Thanks for it!
https://github.com/bigb0x/CVE-2024-29973

To scan a single target:
python CVE-2024-29973.py -u target

To mass scan bulk targets IPs:
python CVE-2024-29973.py -f targets.txt

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →